{"grype_matches":[{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-125350","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-125350","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-13","epss":0.00962,"percentile":0.62163}],"risk":85.57500000000002,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-125350","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]},"relatedVulnerabilities":[{"id":"CVE-2026-125350","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-125350","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-125350","date":"2026-11-13","epss":0.00962,"percentile":0.62163}],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://issues.chromium.org/issues/582442907","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-125350"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-125350","description":"Use after free in XML in Google Chrome prior to 157.0.8103.50 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)","knownExploited":[{"cve":"CVE-2026-125350","cwes":["CWE-416"],"urls":["https://chromereleases.googleblog.com/2026/11/stable-channel-update-for-desktop_018223192.html","https://nvd.nist.gov/vuln/detail/CVE-2026-125350"],"notes":"BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk","dueDate":"2026-11-24","product":"Chromium","dateAdded":"2026-11-10","vendorProject":"Google","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"unknown"}]}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119586","versionConstraint":"<= 3.54.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-13","epss":0.01545,"percentile":0.75383}],"risk":1.2089625,"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."},"relatedVulnerabilities":[]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-13","epss":0.01284,"percentile":0.70569}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-13","epss":0.01284,"percentile":0.70569}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92392","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92392","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-13","epss":0.01284,"percentile":0.70569}],"risk":1.00152,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92392"},"relatedVulnerabilities":[{"id":"CVE-2026-92392","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92392","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92392","date":"2026-11-13","epss":0.01284,"percentile":0.70569}],"urls":["https://curl.se/docs/CVE-2026-92392.html","https://curl.se/docs/CVE-2026-92392.json","https://hackerone.com/reports/4030333","http://www.openwall.com/lists/oss-security/2026/10/18/5","http://www.openwall.com/lists/oss-security/2026/10/18/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92392","description":"During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server\n(with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after\nfree of a `struct Curl_easy` object."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-13","epss":0.01166,"percentile":0.67807}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-13","epss":0.01166,"percentile":0.67807}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92391","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92391","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-13","epss":0.01166,"percentile":0.67807}],"risk":0.8744999999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92391"},"relatedVulnerabilities":[{"id":"CVE-2026-92391","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92391","cwe":"CWE-674","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92391","date":"2026-11-13","epss":0.01166,"percentile":0.67807}],"urls":["https://curl.se/docs/CVE-2026-92391.html","https://curl.se/docs/CVE-2026-92391.json","https://hackerone.com/reports/4024222"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92391","description":"A deeply nested multipart MIME structure constructed via the public API causes\na stack overflow in libcurl during normal cleanup operations. An excessive\nrecursion depth within `curl_mime_free` leads to unbounded stack frame\nallocation during structure traversal, ultimately crashing the host process."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-13","epss":0.01096,"percentile":0.66091}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-13","epss":0.01096,"percentile":0.66091}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86409","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86409","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-13","epss":0.01096,"percentile":0.66091}],"risk":0.8548800000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86409"},"relatedVulnerabilities":[{"id":"CVE-2026-86409","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86409","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86409","date":"2026-11-13","epss":0.01096,"percentile":0.66091}],"urls":["https://curl.se/docs/CVE-2026-86409.html","https://curl.se/docs/CVE-2026-86409.json","https://hackerone.com/reports/3973135"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86409","description":"Setting `CURLOPT_AWS_SIGV4` to NULL but does not disable SigV4 authentication,\ncontrary to expectations and documentation. A subsequent transfer on the same\nhandle still sends an `Authorization: AWS4-HMAC-SHA256` header to whatever URL\nisset next, leaking state information."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-13","epss":0.01045,"percentile":0.64661}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-13","epss":0.01045,"percentile":0.64661}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92387","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92387","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-13","epss":0.01045,"percentile":0.64661}],"risk":0.8151,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92387"},"relatedVulnerabilities":[{"id":"CVE-2026-92387","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92387","cwe":"CWE-835","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92387","date":"2026-11-13","epss":0.01045,"percentile":0.64661}],"urls":["https://curl.se/docs/CVE-2026-92387.html","https://curl.se/docs/CVE-2026-92387.json","https://hackerone.com/reports/4022003"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92387","description":"By permanently omitting the final control-response line, a malicious FTP,\nIMAP, POP3, or SMTP server can exploit libcurl and completely bypass its\nconfigured transfer timeout mechanism, indefinitely blocking all concurrent\ntransfers bound to the same multi-handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-13","epss":0.00995,"percentile":0.63189}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-13","epss":0.00995,"percentile":0.63189}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87862","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87862","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-13","epss":0.00995,"percentile":0.63189}],"risk":0.7761,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87862"},"relatedVulnerabilities":[{"id":"CVE-2026-87862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87862","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87862","date":"2026-11-13","epss":0.00995,"percentile":0.63189}],"urls":["https://curl.se/docs/CVE-2026-87862.html","https://curl.se/docs/CVE-2026-87862.json","https://hackerone.com/reports/3972357"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87862","description":"Importing a `includeSubDomains` parent HSTS entry before a longer-lived child\nentry, silently drops the child. Consequently, when the parent expires, the\nchild's valid HSTS policy is lost, causing curl to issue unencrypted HTTP\nrequests rather than upgrading to HTTPS."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-13","epss":0.00776,"percentile":0.56342}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-13","epss":0.00776,"percentile":0.56342}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94265","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94265","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-13","epss":0.00776,"percentile":0.56342}],"risk":0.7022800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94265"},"relatedVulnerabilities":[{"id":"CVE-2026-94265","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94265","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94265","date":"2026-11-13","epss":0.00776,"percentile":0.56342}],"urls":["https://curl.se/docs/CVE-2026-94265.html","https://curl.se/docs/CVE-2026-94265.json","https://hackerone.com/reports/4040551"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94265","description":"When processing an HTTP redirect to a URL containing userinfo (a\n`username:password` component), curl might erroneously retain and re-transmit\nthe original host's HTTP Negotiate authentication state. Consequently, a\nmalicious server can trigger a redirect containing arbitrary userinfo to force\ncurl to send a freshly minted Kerberos ticket—generated using the ambient\nidentity of the client process to an untrusted third-party host, effectively\nbypassing the domain-scoping restrictions normally enforced by the absence of\n`--location-trusted`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-13","epss":0.00731,"percentile":0.54853}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-13","epss":0.00731,"percentile":0.54853}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86413","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86413","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-13","epss":0.00731,"percentile":0.54853}],"risk":0.661555,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86413"},"relatedVulnerabilities":[{"id":"CVE-2026-86413","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86413","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86413","date":"2026-11-13","epss":0.00731,"percentile":0.54853}],"urls":["https://curl.se/docs/CVE-2026-86413.html","https://curl.se/docs/CVE-2026-86413.json","https://hackerone.com/reports/3993549"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86413","description":"When using an *ambient user* in a first transfer doing Negotiate\nauthentication and asked to follow redirects, curl could pass on its\ncredential details to an unrelated second origin when asked to redirect there."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87863","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87863","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87863"},"relatedVulnerabilities":[{"id":"CVE-2026-87863","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87863","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87863","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"urls":["https://curl.se/docs/CVE-2026-87863.html","https://curl.se/docs/CVE-2026-87863.json","https://hackerone.com/reports/3972373"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87863","description":"An authenticated HTTPS origin can supply an HSTS `max-age` value that the\nparser accepts, but time serialization later fails to process. On 64-bit\nsystems, extreme max-age values compute an absolute expiry within standard\ntime integer limits that exceeds calendar time structure bounds. During cache\nsaves, the original HSTS file is truncated before writing a temporary\nreplacement; when serialization fails, the temporary file is deleted, leaving\nan empty or partial cache. Because the save error is silently ignored during\ncleanup, curl exits successfully despite the data loss."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87864","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87864","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87864"},"relatedVulnerabilities":[{"id":"CVE-2026-87864","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87864","cwe":"CWE-130","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87864","date":"2026-11-13","epss":0.00828,"percentile":0.58045}],"urls":["https://curl.se/docs/CVE-2026-87864.html","https://curl.se/docs/CVE-2026-87864.json","https://hackerone.com/reports/3972403"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87864","description":"Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in\nthe `IMAP APPEND {N}` literal while transmitting line-ending expanded data.\nThe server reads only $N$ bytes for the payload, causing the remaining\noverflow bytes to be interpreted and executed as pipelined IMAP commands\nwithin the authenticated session."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86412","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86412","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86412"},"relatedVulnerabilities":[{"id":"CVE-2026-86412","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86412","cwe":"CWE-754","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86412","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"urls":["https://curl.se/docs/CVE-2026-86412.html","https://curl.se/docs/CVE-2026-86412.json","https://hackerone.com/reports/3973201"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86412","description":"A remote HTTP server can set a cookie that curl accepts and writes to a\nNetscape cookie jar but cannot reload. On the next invocation using the same\npath for `--cookie` and `--cookie-jar`, curl fails before connecting, then the\ncleanup procedure replaces the jar with an empty file, deleting cookies for\nunrelated domains."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92386","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92386","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"risk":0.64584,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92386"},"relatedVulnerabilities":[{"id":"CVE-2026-92386","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92386","cwe":"CWE-1284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92386","date":"2026-11-13","epss":0.00828,"percentile":0.58044}],"urls":["https://curl.se/docs/CVE-2026-92386.html","https://curl.se/docs/CVE-2026-92386.json","https://hackerone.com/reports/4021979"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92386","description":"When writing a long cookie name and value to a Netscape cookie jar, a remote\nHTTP server can make `curl` write a record that exceeds its line-length\nparsing limit. Consequently, any subsequent `curl` invocation reading from\nthat same cookie jar using `--cookie` silently aborts parsing prematurely upon\nencountering the too long line, ignoring all subsequent valid cookies in the\nfile."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-13","epss":0.00699,"percentile":0.53693}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-13","epss":0.00699,"percentile":0.53693}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92388","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92388","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-13","epss":0.00699,"percentile":0.53693}],"risk":0.632595,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92388"},"relatedVulnerabilities":[{"id":"CVE-2026-92388","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92388","cwe":"CWE-416","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92388","date":"2026-11-13","epss":0.00699,"percentile":0.53693}],"urls":["https://curl.se/docs/CVE-2026-92388.html","https://curl.se/docs/CVE-2026-92388.json","https://hackerone.com/reports/4022070"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92388","description":"When an FTP wildcard `LIST` operation fails, libcurl omits the restoration\npath meant for successful listings, leaving the write callback set to the\ninternal listing parser and the write callback data pointing directly to the\neasy handle. Subsequent reuse of this handle triggers an immediate crash, and\ncloning it via `curl_easy_duphandle()` copies this corrupted state into the\nduplicate. If the original handle is subsequently freed, executing a transfer\non the cloned handle causes a heap use-after-free read against the dangling\nhandle reference; alternatively, reusing the original or cloned handle while\nchanging only  `CURLOPT_WRITEDATA` (and omitting `CURLOPT_WRITEFUNCTION`)\nresults in type confusion, forcing the internal parser to interpret incoming\nserver response bytes into memory at the application-supplied write data\npointer."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-13","epss":0.00676,"percentile":0.52808}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-13","epss":0.00676,"percentile":0.52808}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86414","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86414","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-13","epss":0.00676,"percentile":0.52808}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86414"},"relatedVulnerabilities":[{"id":"CVE-2026-86414","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86414","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86414","date":"2026-11-13","epss":0.00676,"percentile":0.52808}],"urls":["https://curl.se/docs/CVE-2026-86414.html","https://curl.se/docs/CVE-2026-86414.json","https://hackerone.com/reports/3993566"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86414","description":"An HTTP proxy can trick libcurl into sending the origin's credentials (Basic\npassword, or a Negotiate/Kerberos ticket) to the proxy itself, by answering\nthe `CONNECT` tunnel request with 401 `WWW-Authenticate:` instead of the\nexpected 407 `Proxy-Authenticate:`."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-13","epss":0.00676,"percentile":0.52807}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-13","epss":0.00676,"percentile":0.52807}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87861","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87861","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-13","epss":0.00676,"percentile":0.52807}],"risk":0.6117800000000001,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87861"},"relatedVulnerabilities":[{"id":"CVE-2026-87861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87861","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87861","date":"2026-11-13","epss":0.00676,"percentile":0.52807}],"urls":["https://curl.se/docs/CVE-2026-87861.html","https://curl.se/docs/CVE-2026-87861.json","https://hackerone.com/reports/3972094"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87861","description":"When using ambient user credentials, an HTTP request directed to one origin\nmay be dispatched over a connection previously authenticated via Negotiate for\na different origin, leaving the request's intended credentials unused."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-13","epss":0.00766,"percentile":0.56037}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-13","epss":0.00766,"percentile":0.56037}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86410","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86410","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-13","epss":0.00766,"percentile":0.56037}],"risk":0.59748,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86410"},"relatedVulnerabilities":[{"id":"CVE-2026-86410","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86410","cwe":"CWE-297","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86410","date":"2026-11-13","epss":0.00766,"percentile":0.56037}],"urls":["https://curl.se/docs/CVE-2026-86410.html","https://curl.se/docs/CVE-2026-86410.json","https://hackerone.com/reports/3973176"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86410","description":"A flaw in the curl command line tool's logic makes it only set SSH host\nverification options when interacting directly using SFTP or SCP, and not as a\nresult of following a redirect."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-13","epss":0.00721,"percentile":0.54497}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-13","epss":0.00721,"percentile":0.54497}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92389","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92389","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-13","epss":0.00721,"percentile":0.54497}],"risk":0.56238,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92389"},"relatedVulnerabilities":[{"id":"CVE-2026-92389","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92389","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92389","date":"2026-11-13","epss":0.00721,"percentile":0.54497}],"urls":["https://curl.se/docs/CVE-2026-92389.html","https://curl.se/docs/CVE-2026-92389.json","https://hackerone.com/reports/4022568"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92389","description":"libcurl's TFTP state machine fails to validate state transitions against the\nrequested transfer direction, accepting opening server responses for both\nreads and writes interchangeably. A malicious TFTP server can respond to a\ndownload request in a way that forces the client into transmit mode, prompting\nlibcurl to consume and transmit data from the handle's persistent\n`CURLOPT_READDATA` pointer - including data remaining from unrelated prior\noperations, such as an HTTP POST request executed on a reused handle."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-13","epss":0.00705,"percentile":0.53903}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-13","epss":0.00705,"percentile":0.53903}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107928","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107928","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-13","epss":0.00705,"percentile":0.53903}],"risk":0.5499,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107928"},"relatedVulnerabilities":[{"id":"CVE-2026-107928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107928","cwe":"CWE-126","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107928","date":"2026-11-13","epss":0.00705,"percentile":0.53903}],"urls":["https://curl.se/docs/CVE-2026-107928.html","https://curl.se/docs/CVE-2026-107928.json","https://hackerone.com/reports/4099194"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107928","description":"When curl is built with GnuTLS, a malicious WebSocket server can make curl\nsend memory past its send buffer. This is due to an out of bounds read\nfollowing when `gnutls_record_send()` returns a number of bytes sent **greater\nthan the number of bytes it was given to send**. GnuTLS does that after a\nblocked send."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-13","epss":0.00667,"percentile":0.52439}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-13","epss":0.00667,"percentile":0.52439}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107929","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-107929","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-13","epss":0.00667,"percentile":0.52439}],"risk":0.52026,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-107929"},"relatedVulnerabilities":[{"id":"CVE-2026-107929","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107929","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-107929","date":"2026-11-13","epss":0.00667,"percentile":0.52439}],"urls":["https://curl.se/docs/CVE-2026-107929.html","https://curl.se/docs/CVE-2026-107929.json","https://hackerone.com/reports/4099618"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107929","description":"When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is\nset with one of the documented prefixes (`if!`, `host!`, `ifhost!`), that\nbinding is not part of the connection reuse key, so a later transfer asking\nfor a different source can silently reuse an existing connection and go out\nfrom the earlier transfer's source address"}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116336","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116336","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116336","date":"2026-11-13","epss":0.00638,"percentile":0.51131}],"risk":0.51997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116336"},"relatedVulnerabilities":[{"id":"CVE-2026-116336","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116336","date":"2026-11-13","epss":0.00638,"percentile":0.51131}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116336/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336","description":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116326","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116326","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116326","date":"2026-11-13","epss":0.00638,"percentile":0.5113}],"risk":0.51997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116326"},"relatedVulnerabilities":[{"id":"CVE-2026-116326","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116326","date":"2026-11-13","epss":0.00638,"percentile":0.5113}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116326/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116326","description":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error.  We have not ruled out arbitrary code execution on some platform.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116315","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116315","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116315","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"risk":0.48574000000000006,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116315"},"relatedVulnerabilities":[{"id":"CVE-2026-116315","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116315","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116315/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116315","description":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116317","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116317","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116317","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"risk":0.48574000000000006,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116317"},"relatedVulnerabilities":[{"id":"CVE-2026-116317","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116317","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116317/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116317","description":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120149","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120149","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120149","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"risk":0.48574000000000006,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120149"},"relatedVulnerabilities":[{"id":"CVE-2026-120149","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120149","date":"2026-11-13","epss":0.00596,"percentile":0.49033}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120149/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120149","description":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.  postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116306","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116306","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116306","date":"2026-11-13","epss":0.0059,"percentile":0.48791}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116306"},"relatedVulnerabilities":[{"id":"CVE-2026-116306","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116306","date":"2026-11-13","epss":0.0059,"percentile":0.48791}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116306/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116306","description":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116307","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116307","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116307","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116307"},"relatedVulnerabilities":[{"id":"CVE-2026-116307","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116307","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116307/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116307","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116319","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116319","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116319","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116319"},"relatedVulnerabilities":[{"id":"CVE-2026-116319","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116319","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116319/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116319","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116320","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116320","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116320","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116320"},"relatedVulnerabilities":[{"id":"CVE-2026-116320","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116320","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116320/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116320","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116323","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116323","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116323","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116323"},"relatedVulnerabilities":[{"id":"CVE-2026-116323","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116323","date":"2026-11-13","epss":0.0059,"percentile":0.4879}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116323/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116323","description":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116328","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116328","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116328","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116328"},"relatedVulnerabilities":[{"id":"CVE-2026-116328","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116328","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116328/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116328","description":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116329","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116329","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116329","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116329"},"relatedVulnerabilities":[{"id":"CVE-2026-116329","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116329","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116329/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116329","description":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120142","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120142","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120142","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120142"},"relatedVulnerabilities":[{"id":"CVE-2026-120142","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120142","date":"2026-11-13","epss":0.0059,"percentile":0.48789}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120142/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120142","description":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116304","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116304","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116304","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116304"},"relatedVulnerabilities":[{"id":"CVE-2026-116304","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116304","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116304/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116304","description":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116309","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116309","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116309","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116309"},"relatedVulnerabilities":[{"id":"CVE-2026-116309","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116309","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116309/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116309","description":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY.  We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116335","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116335","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116335","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116335"},"relatedVulnerabilities":[{"id":"CVE-2026-116335","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116335","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116335/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116335","description":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120151","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120151","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120151","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120151"},"relatedVulnerabilities":[{"id":"CVE-2026-120151","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120151","date":"2026-11-13","epss":0.0059,"percentile":0.48788}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120151/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120151","description":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116331","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116331","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116331","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116331"},"relatedVulnerabilities":[{"id":"CVE-2026-116331","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116331","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116331","description":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116332","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116332","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116332","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116332"},"relatedVulnerabilities":[{"id":"CVE-2026-116332","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116332","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116332/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116332","description":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120147","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120147","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120147","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120147"},"relatedVulnerabilities":[{"id":"CVE-2026-120147","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120147","date":"2026-11-13","epss":0.0059,"percentile":0.48787}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120147/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120147","description":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120139","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120139","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120139","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120139"},"relatedVulnerabilities":[{"id":"CVE-2026-120139","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120139","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120139/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120139","description":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120141","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120141","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120141","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120141"},"relatedVulnerabilities":[{"id":"CVE-2026-120141","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120141","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120141/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120141","description":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types.  json_populate_recordset() is one affected function.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18447","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18447","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-18447","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18447"},"relatedVulnerabilities":[{"id":"CVE-2026-18447","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-18447","date":"2026-11-13","epss":0.0059,"percentile":0.48786}],"urls":["https://www.postgresql.org/support/security/CVE-2026-18447/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18447","description":"Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\".  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120143","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120143","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120143","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120143"},"relatedVulnerabilities":[{"id":"CVE-2026-120143","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120143","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120143/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120143","description":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120144","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120144","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120144","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120144"},"relatedVulnerabilities":[{"id":"CVE-2026-120144","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120144","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120144/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120144","description":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6460","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6460","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-6460","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"risk":0.48085,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6460"},"relatedVulnerabilities":[{"id":"CVE-2026-6460","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-6460","date":"2026-11-13","epss":0.0059,"percentile":0.48785}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6460/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6460","description":"Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120150","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120150","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120150","date":"2026-11-13","epss":0.00577,"percentile":0.48082}],"risk":0.4702550000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120150"},"relatedVulnerabilities":[{"id":"CVE-2026-120150","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120150","date":"2026-11-13","epss":0.00577,"percentile":0.48082}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120150/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120150","description":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-13","epss":0.0051,"percentile":0.4404}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-13","epss":0.0051,"percentile":0.4404}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87866","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87866","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-13","epss":0.0051,"percentile":0.4404}],"risk":0.46155000000000007,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87866"},"relatedVulnerabilities":[{"id":"CVE-2026-87866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87866","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87866","date":"2026-11-13","epss":0.0051,"percentile":0.4404}],"urls":["https://curl.se/docs/CVE-2026-87866.html","https://curl.se/docs/CVE-2026-87866.json","https://hackerone.com/reports/3989514"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87866","description":"When built with wolfSSL, curl can successfully validate a pinned public key\nhash against a key the TLS peer does not possess. During the TLS handshake,\nwolfSSL validates the connection, but curl's subsequent re-parsing of the same\ncertificate - tricked by a manipulated validity length field - extracts and\nmatches a different embedded key, incorrectly authorizing the pinned public\nkey."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6467","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6467","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-6467","date":"2026-11-13","epss":0.00615,"percentile":0.50046}],"risk":0.452025,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6467"},"relatedVulnerabilities":[{"id":"CVE-2026-6467","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-6467","date":"2026-11-13","epss":0.00615,"percentile":0.50046}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6467/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6467","description":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\".  ALTER EXTENSION was also affected.  A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-13","epss":0.00604,"percentile":0.49492}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-13","epss":0.00604,"percentile":0.49492}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87865","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87865","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-13","epss":0.00604,"percentile":0.49492}],"risk":0.44998,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87865"},"relatedVulnerabilities":[{"id":"CVE-2026-87865","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87865","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-87865","date":"2026-11-13","epss":0.00604,"percentile":0.49492}],"urls":["https://curl.se/docs/CVE-2026-87865.html","https://curl.se/docs/CVE-2026-87865.json","https://hackerone.com/reports/3975408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87865","description":"When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated\ninitial entry can cause host key validation to report a key *mismatch* as a\n*missing* key to the `CURLOPT_SSH_KEYFUNCTION` callback."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-13","epss":0.00589,"percentile":0.48726}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-13","epss":0.00589,"percentile":0.48726}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92390","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-92390","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-13","epss":0.00589,"percentile":0.48726}],"risk":0.44175000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-92390"},"relatedVulnerabilities":[{"id":"CVE-2026-92390","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92390","cwe":"CWE-73","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-92390","date":"2026-11-13","epss":0.00589,"percentile":0.48726}],"urls":["https://curl.se/docs/CVE-2026-92390.html","https://curl.se/docs/CVE-2026-92390.json","https://hackerone.com/reports/4023192"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92390","description":"When invoked with `--remote-header-name` (`-J`), curl fails to preserve its\ndocumented anti-clobbering protection if an intermediate 103 Early Hints\nresponse precedes the final HTTP response, or if an `ETag` header is processed\nbefore `Content-Disposition` under `--etag-save`. This flaw allows an HTTP(S)\nserver to overwrite an existing local file specified in the\n`Content-Disposition` header despite the presence of the `-J` non-overwrite\nconstraint."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120145","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120145","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120145","date":"2026-11-13","epss":0.00541,"percentile":0.46017}],"risk":0.44091500000000006,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120145"},"relatedVulnerabilities":[{"id":"CVE-2026-120145","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120145","date":"2026-11-13","epss":0.00541,"percentile":0.46017}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120145/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120145","description":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target.  Only subscriptions owned by a superuser are vulnerable.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116314","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116314","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116314","date":"2026-11-13","epss":0.00527,"percentile":0.45151}],"risk":0.4295050000000001,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116314"},"relatedVulnerabilities":[{"id":"CVE-2026-116314","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116314","date":"2026-11-13","epss":0.00527,"percentile":0.45151}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116314/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116314","description":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive.  Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-13","epss":0.00556,"percentile":0.46918}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-13","epss":0.00556,"percentile":0.46918}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-94266","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-94266","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-13","epss":0.00556,"percentile":0.46918}],"risk":0.41700000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-94266"},"relatedVulnerabilities":[{"id":"CVE-2026-94266","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94266","cwe":"CWE-522","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94266","date":"2026-11-13","epss":0.00556,"percentile":0.46918}],"urls":["https://curl.se/docs/CVE-2026-94266.html","https://curl.se/docs/CVE-2026-94266.json","https://hackerone.com/reports/4041053"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94266","description":"libcurl could accidentally return a URL for `curl_easy_getinfo()`'s\n`CURLINFO_EFFECTIVE_URL` option containing credentials, even though neither\nthe URL provided to libcurl nor the redirected URL did."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120153","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120153","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120153","date":"2026-11-13","epss":0.00552,"percentile":0.46676}],"risk":0.40571999999999997,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120153"},"relatedVulnerabilities":[{"id":"CVE-2026-120153","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120153","date":"2026-11-13","epss":0.00552,"percentile":0.46676}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120153/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120153","description":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings.  This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-13","epss":0.00433,"percentile":0.38077}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-13","epss":0.00433,"percentile":0.38077}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86411","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86411","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-13","epss":0.00433,"percentile":0.38077}],"risk":0.391865,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86411"},"relatedVulnerabilities":[{"id":"CVE-2026-86411","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86411","cwe":"CWE-488","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86411","date":"2026-11-13","epss":0.00433,"percentile":0.38077}],"urls":["https://curl.se/docs/CVE-2026-86411.html","https://curl.se/docs/CVE-2026-86411.json","https://hackerone.com/reports/3973190"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86411","description":"An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP\ncontrol connection that a previous easy handle upgraded with `STARTTLS` and\nauthenticated using a client certificate. The second handle performs neither a\nnew TLS handshake nor a new FTP login, so the server continues to authorize it\nunder the first handle's certificate identity."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116316","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116316","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116316","date":"2026-11-13","epss":0.00479,"percentile":0.41924}],"risk":0.39038500000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116316"},"relatedVulnerabilities":[{"id":"CVE-2026-116316","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116316","date":"2026-11-13","epss":0.00479,"percentile":0.41924}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116316/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116316","description":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp.  The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120148","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120148","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120148","date":"2026-11-13","epss":0.00483,"percentile":0.42185}],"risk":0.37674,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120148"},"relatedVulnerabilities":[{"id":"CVE-2026-120148","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120148","date":"2026-11-13","epss":0.00483,"percentile":0.42185}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120148/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120148","description":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113351","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113351","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-13","epss":0.00494,"percentile":0.42967}],"risk":0.3705,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113351"},"relatedVulnerabilities":[{"id":"CVE-2026-113351","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113351","cwe":"CWE-909","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-113351","date":"2026-11-13","epss":0.00494,"percentile":0.42967}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L1560","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L860-L884","https://github.com/libexpat/libexpat/pull/1431","https://www.vulncheck.com/advisories/libexpat-2.7.2-through-2.9.0-denial-of-service-via-xml-parserreset"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113351","description":"libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte count but never offsets tracked heap allocations. Attackers can submit a large XML document so later documents on the same reset parser fail with XML_ERROR_NO_MEMORY until it is recreated."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116313","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116313","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116313","date":"2026-11-13","epss":0.00499,"percentile":0.43357}],"risk":0.36676499999999995,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116313"},"relatedVulnerabilities":[{"id":"CVE-2026-116313","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116313","date":"2026-11-13","epss":0.00499,"percentile":0.43357}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116313/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116313","description":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query.  The pg_upgrade documentation recommends an affected vacuumdb invocation.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115506","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-115506","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-13","epss":0.00448,"percentile":0.39474}],"risk":0.3628799999999999,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-115506"},"relatedVulnerabilities":[{"id":"CVE-2026-115506","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115506","cwe":"CWE-776","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-115506","date":"2026-11-13","epss":0.00448,"percentile":0.39474}],"urls":["https://github.com/hannob/lololol","https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/issues/1160","https://github.com/libexpat/libexpat/pull/1433","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-denial-of-service-via-billion-laughs-detection-delay"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115506","description":"libexpat through 2.9.0 contains a denial of service vulnerability because billion laughs protection in accountingDiffTolerated() in xmlparse.c detects entity amplification too late. Attackers can supply a moderately sized XML document with a large DTD and nested entity expansions to consume tens of seconds of CPU per parse."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116318","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116318","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116318","date":"2026-11-13","epss":0.0043,"percentile":0.37717}],"risk":0.35045000000000004,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116318"},"relatedVulnerabilities":[{"id":"CVE-2026-116318","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116318","date":"2026-11-13","epss":0.0043,"percentile":0.37717}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116318/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116318","description":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14661","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14661","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-14661","date":"2026-11-13","epss":0.00434,"percentile":0.38194}],"risk":0.33852,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14661"},"relatedVulnerabilities":[{"id":"CVE-2026-14661","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-14661","date":"2026-11-13","epss":0.00434,"percentile":0.38194}],"urls":["https://www.postgresql.org/support/security/CVE-2026-14661/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14661","description":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-117610","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-117610","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-13","epss":0.00425,"percentile":0.37337}],"risk":0.31875000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-117610"},"relatedVulnerabilities":[{"id":"CVE-2026-117610","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-117610","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-117610","date":"2026-11-13","epss":0.00425,"percentile":0.37337}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L3468-L3510","https://github.com/libexpat/libexpat/commit/7b0d50e4b1d16fafd55876260701e04279a7489d","https://github.com/libexpat/libexpat/pull/1444","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-null-pointer-dereference-via-external-entity-subparser"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-117610","description":"libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2() in lib/xmlparse.c that mishandles the XML_TOK_NONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing a later parse to crash the application."}]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119618","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-119618","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-13","epss":0.00408,"percentile":0.35586}],"risk":0.31824,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-119618"},"relatedVulnerabilities":[{"id":"CVE-2026-119618","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-13","epss":0.00408,"percentile":0.35586}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/13","https://access.redhat.com/security/cve/cve-2026-119618","https://bugs.gentoo.org/986161","https://github.com/AlmaLinux/updates/issues/4252","https://github.com/microsoft/azurelinux/pull/20165","https://ubuntu.com/security/CVE-2026-119618","https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119618","description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-87636","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-87636","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-87636","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87636","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-87636","date":"2026-11-13","epss":0.00388,"percentile":0.33429}],"risk":0.31622000000000006,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-87636"},"relatedVulnerabilities":[{"id":"CVE-2026-87636","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-87636","cwe":"CWE-843","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-87636","date":"2026-11-13","epss":0.00388,"percentile":0.33429}],"urls":["https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop_0808145027.html","https://issues.chromium.org/issues/495541478"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-87636","description":"Type confusion in XML in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)"}]},{"artifact":{"id":"ee736a350cb83d66","cpes":["cpe:2.3:a:curl:curl:8.22.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:haxx:curl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"curl","purl":"pkg:apk/alpine/curl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/curl"},{"path":"/usr/bin/wcurl"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-13","epss":0.00419,"percentile":0.3677}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-13","epss":0.00419,"percentile":0.3677}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"f73ce872e0d45f02","cpes":["cpe:2.3:a:libcurl:libcurl:8.22.0-r0:*:*:*:*:*:*:*"],"name":"libcurl","purl":"pkg:apk/alpine/libcurl@8.22.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=curl","type":"apk","version":"8.22.0-r0","language":"","licenses":["curl"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libcurl.so.4"},{"path":"/usr/lib/libcurl.so.4.8.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"curl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"8.23.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86415","versionConstraint":"< 8.23.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"curl","version":"8.22.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-86415","fix":{"state":"fixed","versions":["8.23.0-r0"],"available":[{"date":"2026-10-26","kind":"first-observed","version":"8.23.0-r0"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-13","epss":0.00419,"percentile":0.3677}],"risk":0.31425000000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-86415"},"relatedVulnerabilities":[{"id":"CVE-2026-86415","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86415","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-86415","date":"2026-11-13","epss":0.00419,"percentile":0.3677}],"urls":["https://curl.se/docs/CVE-2026-86415.html","https://curl.se/docs/CVE-2026-86415.json","https://hackerone.com/reports/3993870"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86415","description":"libcurl's connection cache match function never considers the automatic client\ncertificate option, so a cached, already authenticated Schannel connection can\nbe handed to a transfer that got redirected to a different origin, even though\nthe code explicitly switched off the auto client cert option for that transfer\nto prevent exactly this."}]},{"artifact":{"id":"71d5b1bc967e2a74","cpes":["cpe:2.3:a:libexpat:libexpat:2.9.0-r0:*:*:*:*:*:*:*"],"name":"libexpat","purl":"pkg:apk/alpine/libexpat@2.9.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=expat","type":"apk","version":"2.9.0-r0","language":"","licenses":["MIT"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libexpat.so.1"},{"path":"/usr/lib/libexpat.so.1.13.0"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"expat"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.10.0-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-118370","versionConstraint":"< 2.10.0-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"expat","version":"2.9.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-118370","fix":{"state":"fixed","versions":["2.10.0-r0"],"available":[{"date":"2026-11-03","kind":"first-observed","version":"2.10.0-r0"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-13","epss":0.00391,"percentile":0.33754}],"risk":0.30693499999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-118370"},"relatedVulnerabilities":[{"id":"CVE-2026-118370","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-118370","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-118370","date":"2026-11-13","epss":0.00391,"percentile":0.33754}],"urls":["https://github.com/libexpat/libexpat","https://github.com/libexpat/libexpat/blob/a76b1174c1ea52abb639a4c69d52b630a8a106a2/expat/lib/xmlparse.c#L4138-L4140","https://github.com/libexpat/libexpat/commit/1bac53c4fc460a03cd9860f39501c7979f6750ae","https://github.com/libexpat/libexpat/commit/621cb2c78b253ee023a86bc91d6ddb048481c04c","https://github.com/libexpat/libexpat/pull/1450","https://www.vulncheck.com/advisories/libexpat-through-2.9.0-integer-overflow-in-storeatts-via-attindex-and-nprefixes"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-118370","description":"libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts() in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow attIndex and nPrefixes, crashing applications or corrupting heap memory."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116330","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116330","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116330","date":"2026-11-13","epss":0.00373,"percentile":0.31742}],"risk":0.303995,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116330"},"relatedVulnerabilities":[{"id":"CVE-2026-116330","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116330","date":"2026-11-13","epss":0.00373,"percentile":0.31742}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116330/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116330","description":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql.  This is a gap in the fix for CVE-2025-8714.  restore.sql is undocumented.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-13","epss":0.00399,"percentile":0.34721}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116325","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116325","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116325","date":"2026-11-13","epss":0.00375,"percentile":0.31917}],"risk":0.290625,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116325"},"relatedVulnerabilities":[{"id":"CVE-2026-116325","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116325","date":"2026-11-13","epss":0.00375,"percentile":0.31917}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116325/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116325","description":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-13","epss":0.00269,"percentile":0.1923}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-13","epss":0.00269,"percentile":0.1923}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9947","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9947","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-9947","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9947","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-9947","date":"2026-11-13","epss":0.00303,"percentile":0.23358}],"risk":0.24694500000000003,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-9947"},"relatedVulnerabilities":[{"id":"CVE-2026-9947","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9947","cwe":"CWE-416","type":"Secondary","source":"chrome-cve-admin@google.com"}],"epss":[{"cve":"CVE-2026-9947","date":"2026-11-13","epss":0.00303,"percentile":0.23358}],"urls":["https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_0877304591.html","https://issues.chromium.org/issues/503627446"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9947","description":"Use after free in XML in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)"}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119379","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-13","epss":0.00278,"percentile":0.20512}],"risk":0.217535,"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116333","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116333","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116333","date":"2026-11-13","epss":0.00371,"percentile":0.31501}],"risk":0.213325,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116333"},"relatedVulnerabilities":[{"id":"CVE-2026-116333","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116333","date":"2026-11-13","epss":0.00371,"percentile":0.31501}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116333/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116333","description":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-13","epss":0.00428,"percentile":0.37571}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-13","epss":0.00428,"percentile":0.37571}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-13","epss":0.00428,"percentile":0.37571}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-13","epss":0.00428,"percentile":0.37571}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116322","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116322","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116322","date":"2026-11-13","epss":0.00366,"percentile":0.30896}],"risk":0.18849000000000002,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116322"},"relatedVulnerabilities":[{"id":"CVE-2026-116322","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116322","date":"2026-11-13","epss":0.00366,"percentile":0.30896}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116322/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116322","description":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119374","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-13","epss":0.0023,"percentile":0.13966}],"risk":0.179975,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-13","epss":0.00312,"percentile":0.24438}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-13","epss":0.00312,"percentile":0.24438}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-13","epss":0.00312,"percentile":0.24438}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106023","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-106023","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-13","epss":0.00296,"percentile":0.2255}],"risk":0.148,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-106023"},"relatedVulnerabilities":[{"id":"CVE-2026-106023","cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-13","epss":0.00296,"percentile":0.2255}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/11"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106023","description":"NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16237","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16237","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-16237","date":"2026-11-13","epss":0.00272,"percentile":0.19836}],"risk":0.14144,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16237"},"relatedVulnerabilities":[{"id":"CVE-2026-16237","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-16237","date":"2026-11-13","epss":0.00272,"percentile":0.19836}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16237/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16237","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119378","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-13","epss":0.00251,"percentile":0.16578}],"risk":0.13993250000000002,"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116308","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116308","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116308","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"risk":0.137175,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116308"},"relatedVulnerabilities":[{"id":"CVE-2026-116308","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116308","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116308/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116308","description":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116310","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116310","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116310","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"risk":0.137175,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116310"},"relatedVulnerabilities":[{"id":"CVE-2026-116310","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116310","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116310/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116310","description":"Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error.  file_fdw reaches the same code path in affected version 18.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116321","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116321","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116321","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"risk":0.137175,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116321"},"relatedVulnerabilities":[{"id":"CVE-2026-116321","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116321","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116321/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116321","description":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120152","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120152","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120152","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"risk":0.137175,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120152"},"relatedVulnerabilities":[{"id":"CVE-2026-120152","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120152","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120152/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120152","description":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120154","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120154","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120154","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"risk":0.137175,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120154"},"relatedVulnerabilities":[{"id":"CVE-2026-120154","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120154","date":"2026-11-13","epss":0.00295,"percentile":0.22352}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120154/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120154","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116312","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116312","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116312","date":"2026-11-13","epss":0.00251,"percentile":0.16617}],"risk":0.13052,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116312"},"relatedVulnerabilities":[{"id":"CVE-2026-116312","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116312","date":"2026-11-13","epss":0.00251,"percentile":0.16617}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116312/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116312","description":"Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE.  Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected.  Versions before PostgreSQL 15 are unaffected."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119373","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-13","epss":0.00162,"percentile":0.0549}],"risk":0.126765,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109163","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-109163","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-13","epss":0.00247,"percentile":0.1617}],"risk":0.1235,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-109163"},"relatedVulnerabilities":[{"id":"CVE-2026-109163","cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-13","epss":0.00247,"percentile":0.1617}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109163","description":"Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116311","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116311","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116311","date":"2026-11-13","epss":0.0023,"percentile":0.13972}],"risk":0.1196,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116311"},"relatedVulnerabilities":[{"id":"CVE-2026-116311","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116311","date":"2026-11-13","epss":0.0023,"percentile":0.13972}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116311/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116311","description":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120146","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120146","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120146","date":"2026-11-13","epss":0.00254,"percentile":0.17119}],"risk":0.11811,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120146"},"relatedVulnerabilities":[{"id":"CVE-2026-120146","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-120146","date":"2026-11-13","epss":0.00254,"percentile":0.17119}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120146/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120146","description":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role.  It also allows reassignment of database ownership without the CREATEDB privilege.  The equivalent ALTER ... OWNER commands block this.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"risk":0.11515,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"risk":0.11515,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"risk":0.11515,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"risk":0.11515,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114469","date":"2026-11-13","epss":0.00245,"percentile":0.15918}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"risk":0.10904,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"risk":0.10904,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"risk":0.10904,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"risk":0.10904,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114466","date":"2026-11-13","epss":0.00232,"percentile":0.14209}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119375","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-13","epss":0.00195,"percentile":0.09267}],"risk":0.1087125,"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119371","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-13","epss":0.00191,"percentile":0.08874}],"risk":0.1064825,"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116327","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116327","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116327","date":"2026-11-13","epss":0.00224,"percentile":0.13141}],"risk":0.10415999999999997,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116327"},"relatedVulnerabilities":[{"id":"CVE-2026-116327","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116327","date":"2026-11-13","epss":0.00224,"percentile":0.13141}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116327/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116327","description":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119376","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-13","epss":0.00183,"percentile":0.07946}],"risk":0.1020225,"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119591","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-13","epss":0.00171,"percentile":0.06584}],"risk":0.0953325,"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"93a0da5a6bb82d14","cpes":["cpe:2.3:a:libxslt:libxslt:1.1.43-r3:*:*:*:*:*:*:*"],"name":"libxslt","purl":"pkg:apk/alpine/libxslt@1.1.43-r3?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.1.43-r3","language":"","licenses":["X11"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/xsltproc"},{"path":"/usr/lib"},{"path":"/usr/lib/libexslt.so.0"},{"path":"/usr/lib/libexslt.so.0.8.24"},{"path":"/usr/lib/libxslt.so.1"},{"path":"/usr/lib/libxslt.so.1.1.43"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"libxslt"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-10911","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.1.43-r4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-10911","versionConstraint":"< 1.1.43-r4 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"libxslt","version":"1.1.43-r3"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2025-10911","fix":{"state":"fixed","versions":["1.1.43-r4"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"1.1.43-r4"}]},"cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-11-13","epss":0.00173,"percentile":0.06743}],"risk":0.090825,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2025-10911"},"relatedVulnerabilities":[{"id":"CVE-2025-10911","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-10911","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-10911","date":"2026-11-13","epss":0.00173,"percentile":0.06743}],"urls":["https://access.redhat.com/errata/RHSA-2026:11015","https://access.redhat.com/errata/RHSA-2026:26355","https://access.redhat.com/errata/RHSA-2026:28243","https://access.redhat.com/errata/RHSA-2026:28584","https://access.redhat.com/errata/RHSA-2026:29807","https://access.redhat.com/errata/RHSA-2026:29809","https://access.redhat.com/errata/RHSA-2026:29811","https://access.redhat.com/errata/RHSA-2026:29814","https://access.redhat.com/errata/RHSA-2026:29975","https://access.redhat.com/errata/RHSA-2026:29976","https://access.redhat.com/errata/RHSA-2026:30847","https://access.redhat.com/errata/RHSA-2026:33313","https://access.redhat.com/errata/RHSA-2026:44481","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/security/cve/CVE-2025-10911","https://bugzilla.redhat.com/show_bug.cgi?id=2397838","https://gitlab.gnome.org/GNOME/libxslt/-/issues/144","https://gitlab.gnome.org/GNOME/libxslt/-/merge_requests/77"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-10911","description":"A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16240","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16240","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-16240","date":"2026-11-13","epss":0.00269,"percentile":0.19294}],"risk":0.090115,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16240"},"relatedVulnerabilities":[{"id":"CVE-2026-16240","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-16240","date":"2026-11-13","epss":0.00269,"percentile":0.19294}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16240/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16240","description":"Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes.  The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that.  Integrity impact is unlikely; in particular, the applicable formatter does not support %n.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"e25526cfe49b3610","cpes":["cpe:2.3:a:perl:perl:5.42.3-r0:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:apk/alpine/perl@5.42.3-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"5.42.3-r0","language":"","licenses":["Artistic-1.0-Perl OR GPL-1.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/perl"},{"path":"/usr/bin/perl5.42.3"},{"path":"/usr/bin/perldoc"},{"path":"/usr/bin/pod2html"},{"path":"/usr/bin/pod2man"},{"path":"/usr/bin/pod2text"},{"path":"/usr/bin/pod2usage"},{"path":"/usr/bin/podchecker"},{"path":"/usr/bin/streamzip"},{"path":"/usr/lib"},{"path":"/usr/lib/perl5"},{"path":"/usr/lib/perl5/core_perl"},{"path":"/usr/lib/perl5/core_perl/B.pm"},{"path":"/usr/lib/perl5/core_perl/Config.pm"},{"path":"/usr/lib/perl5/core_perl/Config_git.pl"},{"path":"/usr/lib/perl5/core_perl/Config_heavy.pl"},{"path":"/usr/lib/perl5/core_perl/Cwd.pm"},{"path":"/usr/lib/perl5/core_perl/DynaLoader.pm"},{"path":"/usr/lib/perl5/core_perl/Encode.pm"},{"path":"/usr/lib/perl5/core_perl/Errno.pm"},{"path":"/usr/lib/perl5/core_perl/Fcntl.pm"},{"path":"/usr/lib/perl5/core_perl/IO.pm"},{"path":"/usr/lib/perl5/core_perl/O.pm"},{"path":"/usr/lib/perl5/core_perl/Opcode.pm"},{"path":"/usr/lib/perl5/core_perl/POSIX.pm"},{"path":"/usr/lib/perl5/core_perl/SDBM_File.pm"},{"path":"/usr/lib/perl5/core_perl/Socket.pm"},{"path":"/usr/lib/perl5/core_perl/Storable.pm"},{"path":"/usr/lib/perl5/core_perl/attributes.pm"},{"path":"/usr/lib/perl5/core_perl/encoding.pm"},{"path":"/usr/lib/perl5/core_perl/lib.pm"},{"path":"/usr/lib/perl5/core_perl/mro.pm"},{"path":"/usr/lib/perl5/core_perl/ops.pm"},{"path":"/usr/lib/perl5/core_perl/re.pm"},{"path":"/usr/lib/perl5/core_perl/threads.pm"},{"path":"/usr/lib/perl5/core_perl/B"},{"path":"/usr/lib/perl5/core_perl/B/Concise.pm"},{"path":"/usr/lib/perl5/core_perl/B/Showlex.pm"},{"path":"/usr/lib/perl5/core_perl/B/Terse.pm"},{"path":"/usr/lib/perl5/core_perl/B/Xref.pm"},{"path":"/usr/lib/perl5/core_perl/CORE"},{"path":"/usr/lib/perl5/core_perl/CORE/libperl.so"},{"path":"/usr/lib/perl5/core_perl/Compress"},{"path":"/usr/lib/perl5/core_perl/Compress/Raw"},{"path":"/usr/lib/perl5/core_perl/Compress/Raw/Bzip2.pm"},{"path":"/usr/lib/perl5/core_perl/Compress/Raw/Zlib.pm"},{"path":"/usr/lib/perl5/core_perl/Data"},{"path":"/usr/lib/perl5/core_perl/Data/Dumper.pm"},{"path":"/usr/lib/perl5/core_perl/Digest"},{"path":"/usr/lib/perl5/core_perl/Digest/MD5.pm"},{"path":"/usr/lib/perl5/core_perl/Digest/SHA.pm"},{"path":"/usr/lib/perl5/core_perl/Encode"},{"path":"/usr/lib/perl5/core_perl/Encode/Alias.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Byte.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/CJKConstants.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/CN.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Config.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/EBCDIC.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Encoder.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Encoding.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/GSM0338.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Guess.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/JP.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/KR.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Symbol.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/TW.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Unicode.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/CN"},{"path":"/usr/lib/perl5/core_perl/Encode/CN/HZ.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/JP"},{"path":"/usr/lib/perl5/core_perl/Encode/JP/H2Z.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/JP/JIS7.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/KR"},{"path":"/usr/lib/perl5/core_perl/Encode/KR/2022_KR.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/MIME"},{"path":"/usr/lib/perl5/core_perl/Encode/MIME/Header.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/MIME/Name.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/MIME/Header"},{"path":"/usr/lib/perl5/core_perl/Encode/MIME/Header/ISO_2022_JP.pm"},{"path":"/usr/lib/perl5/core_perl/Encode/Unicode"},{"path":"/usr/lib/perl5/core_perl/Encode/Unicode/UTF7.pm"},{"path":"/usr/lib/perl5/core_perl/File"},{"path":"/usr/lib/perl5/core_perl/File/DosGlob.pm"},{"path":"/usr/lib/perl5/core_perl/File/Glob.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec"},{"path":"/usr/lib/perl5/core_perl/File/Spec/AmigaOS.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Cygwin.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Epoc.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Functions.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Mac.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/OS2.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Unix.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/VMS.pm"},{"path":"/usr/lib/perl5/core_perl/File/Spec/Win32.pm"},{"path":"/usr/lib/perl5/core_perl/Filter"},{"path":"/usr/lib/perl5/core_perl/Filter/Util"},{"path":"/usr/lib/perl5/core_perl/Filter/Util/Call.pm"},{"path":"/usr/lib/perl5/core_perl/Hash"},{"path":"/usr/lib/perl5/core_perl/Hash/Util.pm"},{"path":"/usr/lib/perl5/core_perl/Hash/Util"},{"path":"/usr/lib/perl5/core_perl/Hash/Util/FieldHash.pm"},{"path":"/usr/lib/perl5/core_perl/I18N"},{"path":"/usr/lib/perl5/core_perl/I18N/Langinfo.pm"},{"path":"/usr/lib/perl5/core_perl/IO"},{"path":"/usr/lib/perl5/core_perl/IO/Dir.pm"},{"path":"/usr/lib/perl5/core_perl/IO/File.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Handle.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Pipe.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Poll.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Seekable.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Select.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Socket.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Socket"},{"path":"/usr/lib/perl5/core_perl/IO/Socket/INET.pm"},{"path":"/usr/lib/perl5/core_perl/IO/Socket/UNIX.pm"},{"path":"/usr/lib/perl5/core_perl/IPC"},{"path":"/usr/lib/perl5/core_perl/IPC/Msg.pm"},{"path":"/usr/lib/perl5/core_perl/IPC/Semaphore.pm"},{"path":"/usr/lib/perl5/core_perl/IPC/SharedMem.pm"},{"path":"/usr/lib/perl5/core_perl/IPC/SysV.pm"},{"path":"/usr/lib/perl5/core_perl/List"},{"path":"/usr/lib/perl5/core_perl/List/Util.pm"},{"path":"/usr/lib/perl5/core_perl/List/Util"},{"path":"/usr/lib/perl5/core_perl/List/Util/XS.pm"},{"path":"/usr/lib/perl5/core_perl/MIME"},{"path":"/usr/lib/perl5/core_perl/MIME/Base64.pm"},{"path":"/usr/lib/perl5/core_perl/MIME/QuotedPrint.pm"},{"path":"/usr/lib/perl5/core_perl/Math"},{"path":"/usr/lib/perl5/core_perl/Math/BigInt"},{"path":"/usr/lib/perl5/core_perl/Math/BigInt/FastCalc.pm"},{"path":"/usr/lib/perl5/core_perl/PerlIO"},{"path":"/usr/lib/perl5/core_perl/PerlIO/encoding.pm"},{"path":"/usr/lib/perl5/core_perl/PerlIO/mmap.pm"},{"path":"/usr/lib/perl5/core_perl/PerlIO/via.pm"},{"path":"/usr/lib/perl5/core_perl/Scalar"},{"path":"/usr/lib/perl5/core_perl/Scalar/Util.pm"},{"path":"/usr/lib/perl5/core_perl/Scalar/List"},{"path":"/usr/lib/perl5/core_perl/Scalar/List/Utils.pm"},{"path":"/usr/lib/perl5/core_perl/Sub"},{"path":"/usr/lib/perl5/core_perl/Sub/Util.pm"},{"path":"/usr/lib/perl5/core_perl/Sys"},{"path":"/usr/lib/perl5/core_perl/Sys/Hostname.pm"},{"path":"/usr/lib/perl5/core_perl/Sys/Syslog.pm"},{"path":"/usr/lib/perl5/core_perl/Time"},{"path":"/usr/lib/perl5/core_perl/Time/HiRes.pm"},{"path":"/usr/lib/perl5/core_perl/Time/Piece.pm"},{"path":"/usr/lib/perl5/core_perl/Time/Seconds.pm"},{"path":"/usr/lib/perl5/core_perl/Unicode"},{"path":"/usr/lib/perl5/core_perl/Unicode/Collate.pm"},{"path":"/usr/lib/perl5/core_perl/Unicode/Normalize.pm"},{"path":"/usr/lib/perl5/core_perl/Unicode/Collate"},{"path":"/usr/lib/perl5/core_perl/Unicode/Collate/Locale.pm"},{"path":"/usr/lib/perl5/core_perl/auto"},{"path":"/usr/lib/perl5/core_perl/auto/B"},{"path":"/usr/lib/perl5/core_perl/auto/B/B.so"},{"path":"/usr/lib/perl5/core_perl/auto/Compress"},{"path":"/usr/lib/perl5/core_perl/auto/Compress/Raw"},{"path":"/usr/lib/perl5/core_perl/auto/Compress/Raw/Bzip2"},{"path":"/usr/lib/perl5/core_perl/auto/Compress/Raw/Bzip2/Bzip2.so"},{"path":"/usr/lib/perl5/core_perl/auto/Compress/Raw/Zlib"},{"path":"/usr/lib/perl5/core_perl/auto/Compress/Raw/Zlib/Zlib.so"},{"path":"/usr/lib/perl5/core_perl/auto/Cwd"},{"path":"/usr/lib/perl5/core_perl/auto/Cwd/Cwd.so"},{"path":"/usr/lib/perl5/core_perl/auto/Data"},{"path":"/usr/lib/perl5/core_perl/auto/Data/Dumper"},{"path":"/usr/lib/perl5/core_perl/auto/Data/Dumper/Dumper.so"},{"path":"/usr/lib/perl5/core_perl/auto/Devel"},{"path":"/usr/lib/perl5/core_perl/auto/Devel/Peek"},{"path":"/usr/lib/perl5/core_perl/auto/Devel/Peek/Peek.so"},{"path":"/usr/lib/perl5/core_perl/auto/Digest"},{"path":"/usr/lib/perl5/core_perl/auto/Digest/MD5"},{"path":"/usr/lib/perl5/core_perl/auto/Digest/MD5/MD5.so"},{"path":"/usr/lib/perl5/core_perl/auto/Digest/SHA"},{"path":"/usr/lib/perl5/core_perl/auto/Digest/SHA/SHA.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Encode.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Byte"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Byte/Byte.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/CN"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/CN/CN.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/EBCDIC"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/EBCDIC/EBCDIC.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/JP"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/JP/JP.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/KR"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/KR/KR.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Symbol"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Symbol/Symbol.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/TW"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/TW/TW.so"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Unicode"},{"path":"/usr/lib/perl5/core_perl/auto/Encode/Unicode/Unicode.so"},{"path":"/usr/lib/perl5/core_perl/auto/Fcntl"},{"path":"/usr/lib/perl5/core_perl/auto/Fcntl/Fcntl.so"},{"path":"/usr/lib/perl5/core_perl/auto/File"},{"path":"/usr/lib/perl5/core_perl/auto/File/DosGlob"},{"path":"/usr/lib/perl5/core_perl/auto/File/DosGlob/DosGlob.so"},{"path":"/usr/lib/perl5/core_perl/auto/File/Glob"},{"path":"/usr/lib/perl5/core_perl/auto/File/Glob/Glob.so"},{"path":"/usr/lib/perl5/core_perl/auto/Filter"},{"path":"/usr/lib/perl5/core_perl/auto/Filter/Util"},{"path":"/usr/lib/perl5/core_perl/auto/Filter/Util/Call"},{"path":"/usr/lib/perl5/core_perl/auto/Filter/Util/Call/Call.so"},{"path":"/usr/lib/perl5/core_perl/auto/Hash"},{"path":"/usr/lib/perl5/core_perl/auto/Hash/Util"},{"path":"/usr/lib/perl5/core_perl/auto/Hash/Util/Util.so"},{"path":"/usr/lib/perl5/core_perl/auto/Hash/Util/FieldHash"},{"path":"/usr/lib/perl5/core_perl/auto/Hash/Util/FieldHash/FieldHash.so"},{"path":"/usr/lib/perl5/core_perl/auto/I18N"},{"path":"/usr/lib/perl5/core_perl/auto/I18N/Langinfo"},{"path":"/usr/lib/perl5/core_perl/auto/I18N/Langinfo/Langinfo.so"},{"path":"/usr/lib/perl5/core_perl/auto/IO"},{"path":"/usr/lib/perl5/core_perl/auto/IO/IO.so"},{"path":"/usr/lib/perl5/core_perl/auto/IPC"},{"path":"/usr/lib/perl5/core_perl/auto/IPC/SysV"},{"path":"/usr/lib/perl5/core_perl/auto/IPC/SysV/SysV.so"},{"path":"/usr/lib/perl5/core_perl/auto/List"},{"path":"/usr/lib/perl5/core_perl/auto/List/Util"},{"path":"/usr/lib/perl5/core_perl/auto/List/Util/Util.so"},{"path":"/usr/lib/perl5/core_perl/auto/MIME"},{"path":"/usr/lib/perl5/core_perl/auto/MIME/Base64"},{"path":"/usr/lib/perl5/core_perl/auto/MIME/Base64/Base64.so"},{"path":"/usr/lib/perl5/core_perl/auto/Math"},{"path":"/usr/lib/perl5/core_perl/auto/Math/BigInt"},{"path":"/usr/lib/perl5/core_perl/auto/Math/BigInt/FastCalc"},{"path":"/usr/lib/perl5/core_perl/auto/Math/BigInt/FastCalc/FastCalc.so"},{"path":"/usr/lib/perl5/core_perl/auto/Opcode"},{"path":"/usr/lib/perl5/core_perl/auto/Opcode/Opcode.so"},{"path":"/usr/lib/perl5/core_perl/auto/POSIX"},{"path":"/usr/lib/perl5/core_perl/auto/POSIX/POSIX.so"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/encoding"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/encoding/encoding.so"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/mmap"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/mmap/mmap.so"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/via"},{"path":"/usr/lib/perl5/core_perl/auto/PerlIO/via/via.so"},{"path":"/usr/lib/perl5/core_perl/auto/SDBM_File"},{"path":"/usr/lib/perl5/core_perl/auto/SDBM_File/SDBM_File.so"},{"path":"/usr/lib/perl5/core_perl/auto/Socket"},{"path":"/usr/lib/perl5/core_perl/auto/Socket/Socket.so"},{"path":"/usr/lib/perl5/core_perl/auto/Storable"},{"path":"/usr/lib/perl5/core_perl/auto/Storable/Storable.so"},{"path":"/usr/lib/perl5/core_perl/auto/Sys"},{"path":"/usr/lib/perl5/core_perl/auto/Sys/Hostname"},{"path":"/usr/lib/perl5/core_perl/auto/Sys/Hostname/Hostname.so"},{"path":"/usr/lib/perl5/core_perl/auto/Sys/Syslog"},{"path":"/usr/lib/perl5/core_perl/auto/Sys/Syslog/Syslog.so"},{"path":"/usr/lib/perl5/core_perl/auto/Time"},{"path":"/usr/lib/perl5/core_perl/auto/Time/HiRes"},{"path":"/usr/lib/perl5/core_perl/auto/Time/HiRes/HiRes.so"},{"path":"/usr/lib/perl5/core_perl/auto/Time/Piece"},{"path":"/usr/lib/perl5/core_perl/auto/Time/Piece/Piece.so"},{"path":"/usr/lib/perl5/core_perl/auto/Unicode"},{"path":"/usr/lib/perl5/core_perl/auto/Unicode/Collate"},{"path":"/usr/lib/perl5/core_perl/auto/Unicode/Collate/Collate.so"},{"path":"/usr/lib/perl5/core_perl/auto/Unicode/Normalize"},{"path":"/usr/lib/perl5/core_perl/auto/Unicode/Normalize/Normalize.so"},{"path":"/usr/lib/perl5/core_perl/auto/attributes"},{"path":"/usr/lib/perl5/core_perl/auto/attributes/attributes.so"},{"path":"/usr/lib/perl5/core_perl/auto/mro"},{"path":"/usr/lib/perl5/core_perl/auto/mro/mro.so"},{"path":"/usr/lib/perl5/core_perl/auto/re"},{"path":"/usr/lib/perl5/core_perl/auto/re/re.so"},{"path":"/usr/lib/perl5/core_perl/auto/threads"},{"path":"/usr/lib/perl5/core_perl/auto/threads/threads.so"},{"path":"/usr/lib/perl5/core_perl/auto/threads/shared"},{"path":"/usr/lib/perl5/core_perl/auto/threads/shared/shared.so"},{"path":"/usr/lib/perl5/core_perl/threads"},{"path":"/usr/lib/perl5/core_perl/threads/shared.pm"},{"path":"/usr/local"},{"path":"/usr/local/lib"},{"path":"/usr/local/lib/perl5"},{"path":"/usr/local/lib/perl5/site_perl"},{"path":"/usr/local/share"},{"path":"/usr/local/share/perl5"},{"path":"/usr/local/share/perl5/site_perl"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/core_perl"},{"path":"/usr/share/perl5/core_perl/AnyDBM_File.pm"},{"path":"/usr/share/perl5/core_perl/AutoLoader.pm"},{"path":"/usr/share/perl5/core_perl/AutoSplit.pm"},{"path":"/usr/share/perl5/core_perl/Benchmark.pm"},{"path":"/usr/share/perl5/core_perl/CPAN.pm"},{"path":"/usr/share/perl5/core_perl/Carp.pm"},{"path":"/usr/share/perl5/core_perl/DB.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter.pm"},{"path":"/usr/share/perl5/core_perl/Digest.pm"},{"path":"/usr/share/perl5/core_perl/DirHandle.pm"},{"path":"/usr/share/perl5/core_perl/Dumpvalue.pm"},{"path":"/usr/share/perl5/core_perl/English.pm"},{"path":"/usr/share/perl5/core_perl/Env.pm"},{"path":"/usr/share/perl5/core_perl/Exporter.pm"},{"path":"/usr/share/perl5/core_perl/Fatal.pm"},{"path":"/usr/share/perl5/core_perl/FileCache.pm"},{"path":"/usr/share/perl5/core_perl/FileHandle.pm"},{"path":"/usr/share/perl5/core_perl/FindBin.pm"},{"path":"/usr/share/perl5/core_perl/Memoize.pm"},{"path":"/usr/share/perl5/core_perl/NEXT.pm"},{"path":"/usr/share/perl5/core_perl/PerlIO.pm"},{"path":"/usr/share/perl5/core_perl/Safe.pm"},{"path":"/usr/share/perl5/core_perl/SelectSaver.pm"},{"path":"/usr/share/perl5/core_perl/SelfLoader.pm"},{"path":"/usr/share/perl5/core_perl/Symbol.pm"},{"path":"/usr/share/perl5/core_perl/Test.pm"},{"path":"/usr/share/perl5/core_perl/Test2.pm"},{"path":"/usr/share/perl5/core_perl/Thread.pm"},{"path":"/usr/share/perl5/core_perl/UNIVERSAL.pm"},{"path":"/usr/share/perl5/core_perl/XSLoader.pm"},{"path":"/usr/share/perl5/core_perl/_charnames.pm"},{"path":"/usr/share/perl5/core_perl/autodie.pm"},{"path":"/usr/share/perl5/core_perl/autouse.pm"},{"path":"/usr/share/perl5/core_perl/base.pm"},{"path":"/usr/share/perl5/core_perl/bigfloat.pm"},{"path":"/usr/share/perl5/core_perl/bigint.pm"},{"path":"/usr/share/perl5/core_perl/bignum.pm"},{"path":"/usr/share/perl5/core_perl/bigrat.pm"},{"path":"/usr/share/perl5/core_perl/blib.pm"},{"path":"/usr/share/perl5/core_perl/builtin.pm"},{"path":"/usr/share/perl5/core_perl/bytes.pm"},{"path":"/usr/share/perl5/core_perl/charnames.pm"},{"path":"/usr/share/perl5/core_perl/constant.pm"},{"path":"/usr/share/perl5/core_perl/deprecate.pm"},{"path":"/usr/share/perl5/core_perl/diagnostics.pm"},{"path":"/usr/share/perl5/core_perl/dumpvar.pl"},{"path":"/usr/share/perl5/core_perl/experimental.pm"},{"path":"/usr/share/perl5/core_perl/feature.pm"},{"path":"/usr/share/perl5/core_perl/fields.pm"},{"path":"/usr/share/perl5/core_perl/filetest.pm"},{"path":"/usr/share/perl5/core_perl/if.pm"},{"path":"/usr/share/perl5/core_perl/integer.pm"},{"path":"/usr/share/perl5/core_perl/less.pm"},{"path":"/usr/share/perl5/core_perl/locale.pm"},{"path":"/usr/share/perl5/core_perl/meta_notation.pm"},{"path":"/usr/share/perl5/core_perl/ok.pm"},{"path":"/usr/share/perl5/core_perl/open.pm"},{"path":"/usr/share/perl5/core_perl/overload.pm"},{"path":"/usr/share/perl5/core_perl/overloading.pm"},{"path":"/usr/share/perl5/core_perl/parent.pm"},{"path":"/usr/share/perl5/core_perl/perl5db.pl"},{"path":"/usr/share/perl5/core_perl/perlfaq.pm"},{"path":"/usr/share/perl5/core_perl/sigtrap.pm"},{"path":"/usr/share/perl5/core_perl/sort.pm"},{"path":"/usr/share/perl5/core_perl/stable.pm"},{"path":"/usr/share/perl5/core_perl/strict.pm"},{"path":"/usr/share/perl5/core_perl/subs.pm"},{"path":"/usr/share/perl5/core_perl/utf8.pm"},{"path":"/usr/share/perl5/core_perl/vars.pm"},{"path":"/usr/share/perl5/core_perl/version.pm"},{"path":"/usr/share/perl5/core_perl/vmsish.pm"},{"path":"/usr/share/perl5/core_perl/warnings.pm"},{"path":"/usr/share/perl5/core_perl/App"},{"path":"/usr/share/perl5/core_perl/App/Cpan.pm"},{"path":"/usr/share/perl5/core_perl/App/Prove.pm"},{"path":"/usr/share/perl5/core_perl/App/Prove"},{"path":"/usr/share/perl5/core_perl/App/Prove/State.pm"},{"path":"/usr/share/perl5/core_perl/App/Prove/State"},{"path":"/usr/share/perl5/core_perl/App/Prove/State/Result.pm"},{"path":"/usr/share/perl5/core_perl/App/Prove/State/Result"},{"path":"/usr/share/perl5/core_perl/App/Prove/State/Result/Test.pm"},{"path":"/usr/share/perl5/core_perl/Archive"},{"path":"/usr/share/perl5/core_perl/Archive/Tar.pm"},{"path":"/usr/share/perl5/core_perl/Archive/Tar"},{"path":"/usr/share/perl5/core_perl/Archive/Tar/Constant.pm"},{"path":"/usr/share/perl5/core_perl/Archive/Tar/File.pm"},{"path":"/usr/share/perl5/core_perl/Attribute"},{"path":"/usr/share/perl5/core_perl/Attribute/Handlers.pm"},{"path":"/usr/share/perl5/core_perl/B"},{"path":"/usr/share/perl5/core_perl/B/Deparse.pm"},{"path":"/usr/share/perl5/core_perl/B/Op_private.pm"},{"path":"/usr/share/perl5/core_perl/CPAN"},{"path":"/usr/share/perl5/core_perl/CPAN/Author.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Bundle.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/CacheMgr.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Complete.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Debug.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/DeferredCode.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Distribution.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Distroprefs.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Distrostatus.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/FTP.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/FirstTime.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/HandleConfig.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Index.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/InfoObj.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Kwalify.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Mirrors.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Module.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Nox.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Plugin.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Prompt.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Queue.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Shell.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Tarzip.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/URL.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Version.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Exception"},{"path":"/usr/share/perl5/core_perl/CPAN/Exception/RecursiveDependency.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Exception/blocked_urllist.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Exception/yaml_not_installed.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Exception/yaml_process_error.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/FTP"},{"path":"/usr/share/perl5/core_perl/CPAN/FTP/netrc.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/HTTP"},{"path":"/usr/share/perl5/core_perl/CPAN/HTTP/Client.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/HTTP/Credentials.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Kwalify"},{"path":"/usr/share/perl5/core_perl/CPAN/Kwalify/distroprefs.dd"},{"path":"/usr/share/perl5/core_perl/CPAN/Kwalify/distroprefs.yml"},{"path":"/usr/share/perl5/core_perl/CPAN/LWP"},{"path":"/usr/share/perl5/core_perl/CPAN/LWP/UserAgent.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Converter.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Feature.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/History.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Merge.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Prereqs.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Requirements.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Spec.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Validator.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/YAML.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Requirements"},{"path":"/usr/share/perl5/core_perl/CPAN/Meta/Requirements/Range.pm"},{"path":"/usr/share/perl5/core_perl/CPAN/Plugin"},{"path":"/usr/share/perl5/core_perl/CPAN/Plugin/Specfile.pm"},{"path":"/usr/share/perl5/core_perl/Carp"},{"path":"/usr/share/perl5/core_perl/Carp/Heavy.pm"},{"path":"/usr/share/perl5/core_perl/Class"},{"path":"/usr/share/perl5/core_perl/Class/Struct.pm"},{"path":"/usr/share/perl5/core_perl/Compress"},{"path":"/usr/share/perl5/core_perl/Compress/Zlib.pm"},{"path":"/usr/share/perl5/core_perl/Config"},{"path":"/usr/share/perl5/core_perl/Config/Extensions.pm"},{"path":"/usr/share/perl5/core_perl/Config/Perl"},{"path":"/usr/share/perl5/core_perl/Config/Perl/V.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter"},{"path":"/usr/share/perl5/core_perl/DBM_Filter/compress.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter/encode.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter/int32.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter/null.pm"},{"path":"/usr/share/perl5/core_perl/DBM_Filter/utf8.pm"},{"path":"/usr/share/perl5/core_perl/Devel"},{"path":"/usr/share/perl5/core_perl/Devel/SelfStubber.pm"},{"path":"/usr/share/perl5/core_perl/Digest"},{"path":"/usr/share/perl5/core_perl/Digest/base.pm"},{"path":"/usr/share/perl5/core_perl/Digest/file.pm"},{"path":"/usr/share/perl5/core_perl/Exporter"},{"path":"/usr/share/perl5/core_perl/Exporter/Heavy.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Command.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Embed.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Install.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Installed.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Liblist.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MANIFEST.SKIP"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_AIX.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Any.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_BeOS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Cygwin.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_DOS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Darwin.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_MacOS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_NW5.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_OS2.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_OS390.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_QNX.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_UWIN.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Unix.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_VMS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_VOS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Win32.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MM_Win95.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MY.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MakeMaker.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Manifest.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Miniperl.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Mkbootstrap.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Mksymlists.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/PL2Bat.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Packlist.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/testlib.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/typemap"},{"path":"/usr/share/perl5/core_perl/ExtUtils/xsubpp"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Base.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Unix.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/VMS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Windows.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/aix.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/android.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/cygwin.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/darwin.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/dec_osf.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/os2.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Windows"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Windows/BCC.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Windows/GCC.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/CBuilder/Platform/Windows/MSVC.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Command"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Command/MM.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant/Base.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant/ProxySubs.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant/Utils.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Constant/XS.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Liblist"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Liblist/Kid.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MakeMaker"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MakeMaker/Config.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MakeMaker/Locale.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/MakeMaker/version.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS/Constants.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS/CountLines.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS/Eval.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS/Node.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/ParseXS/Utilities.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps/Cmd.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps/InputMap.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps/OutputMap.pm"},{"path":"/usr/share/perl5/core_perl/ExtUtils/Typemaps/Type.pm"},{"path":"/usr/share/perl5/core_perl/File"},{"path":"/usr/share/perl5/core_perl/File/Basename.pm"},{"path":"/usr/share/perl5/core_perl/File/Compare.pm"},{"path":"/usr/share/perl5/core_perl/File/Copy.pm"},{"path":"/usr/share/perl5/core_perl/File/Fetch.pm"},{"path":"/usr/share/perl5/core_perl/File/Find.pm"},{"path":"/usr/share/perl5/core_perl/File/GlobMapper.pm"},{"path":"/usr/share/perl5/core_perl/File/Path.pm"},{"path":"/usr/share/perl5/core_perl/File/Temp.pm"},{"path":"/usr/share/perl5/core_perl/File/stat.pm"},{"path":"/usr/share/perl5/core_perl/Filter"},{"path":"/usr/share/perl5/core_perl/Filter/Simple.pm"},{"path":"/usr/share/perl5/core_perl/Getopt"},{"path":"/usr/share/perl5/core_perl/Getopt/Long.pm"},{"path":"/usr/share/perl5/core_perl/Getopt/Std.pm"},{"path":"/usr/share/perl5/core_perl/Getopt/Long"},{"path":"/usr/share/perl5/core_perl/Getopt/Long/Parser.pm"},{"path":"/usr/share/perl5/core_perl/HTTP"},{"path":"/usr/share/perl5/core_perl/HTTP/Tiny.pm"},{"path":"/usr/share/perl5/core_perl/I18N"},{"path":"/usr/share/perl5/core_perl/I18N/Collate.pm"},{"path":"/usr/share/perl5/core_perl/I18N/LangTags.pm"},{"path":"/usr/share/perl5/core_perl/I18N/LangTags"},{"path":"/usr/share/perl5/core_perl/I18N/LangTags/Detect.pm"},{"path":"/usr/share/perl5/core_perl/I18N/LangTags/List.pm"},{"path":"/usr/share/perl5/core_perl/IO"},{"path":"/usr/share/perl5/core_perl/IO/Compress.pm"},{"path":"/usr/share/perl5/core_perl/IO/Zlib.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Base.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Bzip2.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Deflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Gzip.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/RawDeflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zip.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Adapter"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Adapter/Bzip2.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Adapter/Deflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Adapter/Identity.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Base"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Base/Common.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Gzip"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Gzip/Constants.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zip"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zip/Constants.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zlib"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zlib/Constants.pm"},{"path":"/usr/share/perl5/core_perl/IO/Compress/Zlib/Extra.pm"},{"path":"/usr/share/perl5/core_perl/IO/Socket"},{"path":"/usr/share/perl5/core_perl/IO/Socket/IP.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/AnyInflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/AnyUncompress.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Base.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Bunzip2.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Gunzip.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Inflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/RawInflate.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Unzip.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Adapter"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Adapter/Bunzip2.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Adapter/Identity.pm"},{"path":"/usr/share/perl5/core_perl/IO/Uncompress/Adapter/Inflate.pm"},{"path":"/usr/share/perl5/core_perl/IPC"},{"path":"/usr/share/perl5/core_perl/IPC/Cmd.pm"},{"path":"/usr/share/perl5/core_perl/IPC/Open2.pm"},{"path":"/usr/share/perl5/core_perl/IPC/Open3.pm"},{"path":"/usr/share/perl5/core_perl/JSON"},{"path":"/usr/share/perl5/core_perl/JSON/PP.pm"},{"path":"/usr/share/perl5/core_perl/JSON/PP"},{"path":"/usr/share/perl5/core_perl/JSON/PP/Boolean.pm"},{"path":"/usr/share/perl5/core_perl/Locale"},{"path":"/usr/share/perl5/core_perl/Locale/Maketext.pm"},{"path":"/usr/share/perl5/core_perl/Locale/Maketext"},{"path":"/usr/share/perl5/core_perl/Locale/Maketext/Guts.pm"},{"path":"/usr/share/perl5/core_perl/Locale/Maketext/GutsLoader.pm"},{"path":"/usr/share/perl5/core_perl/Locale/Maketext/Simple.pm"},{"path":"/usr/share/perl5/core_perl/Math"},{"path":"/usr/share/perl5/core_perl/Math/BigFloat.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigInt.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigRat.pm"},{"path":"/usr/share/perl5/core_perl/Math/Complex.pm"},{"path":"/usr/share/perl5/core_perl/Math/Trig.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigFloat"},{"path":"/usr/share/perl5/core_perl/Math/BigFloat/Trace.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigInt"},{"path":"/usr/share/perl5/core_perl/Math/BigInt/Calc.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigInt/Lib.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigInt/Trace.pm"},{"path":"/usr/share/perl5/core_perl/Math/BigRat"},{"path":"/usr/share/perl5/core_perl/Math/BigRat/Trace.pm"},{"path":"/usr/share/perl5/core_perl/Memoize"},{"path":"/usr/share/perl5/core_perl/Memoize/AnyDBM_File.pm"},{"path":"/usr/share/perl5/core_perl/Memoize/Expire.pm"},{"path":"/usr/share/perl5/core_perl/Memoize/NDBM_File.pm"},{"path":"/usr/share/perl5/core_perl/Memoize/SDBM_File.pm"},{"path":"/usr/share/perl5/core_perl/Memoize/Storable.pm"},{"path":"/usr/share/perl5/core_perl/Module"},{"path":"/usr/share/perl5/core_perl/Module/CoreList.pm"},{"path":"/usr/share/perl5/core_perl/Module/Load.pm"},{"path":"/usr/share/perl5/core_perl/Module/Loaded.pm"},{"path":"/usr/share/perl5/core_perl/Module/Metadata.pm"},{"path":"/usr/share/perl5/core_perl/Module/CoreList"},{"path":"/usr/share/perl5/core_perl/Module/CoreList/Utils.pm"},{"path":"/usr/share/perl5/core_perl/Module/Load"},{"path":"/usr/share/perl5/core_perl/Module/Load/Conditional.pm"},{"path":"/usr/share/perl5/core_perl/Net"},{"path":"/usr/share/perl5/core_perl/Net/Cmd.pm"},{"path":"/usr/share/perl5/core_perl/Net/Config.pm"},{"path":"/usr/share/perl5/core_perl/Net/Domain.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP.pm"},{"path":"/usr/share/perl5/core_perl/Net/NNTP.pm"},{"path":"/usr/share/perl5/core_perl/Net/Netrc.pm"},{"path":"/usr/share/perl5/core_perl/Net/POP3.pm"},{"path":"/usr/share/perl5/core_perl/Net/Ping.pm"},{"path":"/usr/share/perl5/core_perl/Net/SMTP.pm"},{"path":"/usr/share/perl5/core_perl/Net/Time.pm"},{"path":"/usr/share/perl5/core_perl/Net/hostent.pm"},{"path":"/usr/share/perl5/core_perl/Net/netent.pm"},{"path":"/usr/share/perl5/core_perl/Net/protoent.pm"},{"path":"/usr/share/perl5/core_perl/Net/servent.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP"},{"path":"/usr/share/perl5/core_perl/Net/FTP/A.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP/E.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP/I.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP/L.pm"},{"path":"/usr/share/perl5/core_perl/Net/FTP/dataconn.pm"},{"path":"/usr/share/perl5/core_perl/Params"},{"path":"/usr/share/perl5/core_perl/Params/Check.pm"},{"path":"/usr/share/perl5/core_perl/Parse"},{"path":"/usr/share/perl5/core_perl/Parse/CPAN"},{"path":"/usr/share/perl5/core_perl/Parse/CPAN/Meta.pm"},{"path":"/usr/share/perl5/core_perl/Perl"},{"path":"/usr/share/perl5/core_perl/Perl/OSType.pm"},{"path":"/usr/share/perl5/core_perl/PerlIO"},{"path":"/usr/share/perl5/core_perl/PerlIO/scalar.pm"},{"path":"/usr/share/perl5/core_perl/PerlIO/via"},{"path":"/usr/share/perl5/core_perl/PerlIO/via/QuotedPrint.pm"},{"path":"/usr/share/perl5/core_perl/Pod"},{"path":"/usr/share/perl5/core_perl/Pod/Checker.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Escapes.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Functions.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Html.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Man.pm"},{"path":"/usr/share/perl5/core_perl/Pod/ParseLink.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Text.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Usage.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Html"},{"path":"/usr/share/perl5/core_perl/Pod/Html/Util.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/BaseTo.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/GetOptsOO.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToANSI.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToChecker.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToMan.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToNroff.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToPod.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToRtf.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToTerm.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToText.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToTk.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Perldoc/ToXml.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/BlackBox.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Checker.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Debug.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/DumpAsText.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/DumpAsXML.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/HTML.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/HTMLBatch.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/HTMLLegacy.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/JustPod.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/LinkSection.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Methody.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Progress.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/PullParser.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/PullParserEndToken.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/PullParserStartToken.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/PullParserTextToken.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/PullParserToken.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/RTF.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Search.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/SimpleTree.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Text.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/TextContent.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/TiedOutFH.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/Transcode.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/TranscodeDumb.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/TranscodeSmart.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/XHTML.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Simple/XMLOutStream.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Text"},{"path":"/usr/share/perl5/core_perl/Pod/Text/Color.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Text/Overstrike.pm"},{"path":"/usr/share/perl5/core_perl/Pod/Text/Termcap.pm"},{"path":"/usr/share/perl5/core_perl/Search"},{"path":"/usr/share/perl5/core_perl/Search/Dict.pm"},{"path":"/usr/share/perl5/core_perl/TAP"},{"path":"/usr/share/perl5/core_perl/TAP/Base.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Harness.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Object.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Base.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Color.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Console.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/File.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Session.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Console"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Console/ParallelSession.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/Console/Session.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/File"},{"path":"/usr/share/perl5/core_perl/TAP/Formatter/File/Session.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Harness"},{"path":"/usr/share/perl5/core_perl/TAP/Harness/Env.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Aggregator.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Grammar.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Iterator.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/IteratorFactory.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Multiplexer.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/ResultFactory.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Scheduler.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Source.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Iterator"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Iterator/Array.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Iterator/Process.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Iterator/Stream.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Bailout.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Comment.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Plan.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Pragma.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Test.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Unknown.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/Version.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Result/YAML.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Scheduler"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Scheduler/Job.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/Scheduler/Spinner.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler/Executable.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler/File.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler/Handle.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler/Perl.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/SourceHandler/RawTAP.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/YAMLish"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/YAMLish/Reader.pm"},{"path":"/usr/share/perl5/core_perl/TAP/Parser/YAMLish/Writer.pm"},{"path":"/usr/share/perl5/core_perl/Term"},{"path":"/usr/share/perl5/core_perl/Term/ANSIColor.pm"},{"path":"/usr/share/perl5/core_perl/Term/Cap.pm"},{"path":"/usr/share/perl5/core_perl/Term/Complete.pm"},{"path":"/usr/share/perl5/core_perl/Term/ReadLine.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table"},{"path":"/usr/share/perl5/core_perl/Term/Table/Cell.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table/CellStack.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table/HashBase.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table/LineBreak.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table/Spacer.pm"},{"path":"/usr/share/perl5/core_perl/Term/Table/Util.pm"},{"path":"/usr/share/perl5/core_perl/Test"},{"path":"/usr/share/perl5/core_perl/Test/Builder.pm"},{"path":"/usr/share/perl5/core_perl/Test/Harness.pm"},{"path":"/usr/share/perl5/core_perl/Test/More.pm"},{"path":"/usr/share/perl5/core_perl/Test/Simple.pm"},{"path":"/usr/share/perl5/core_perl/Test/Tester.pm"},{"path":"/usr/share/perl5/core_perl/Test/Builder"},{"path":"/usr/share/perl5/core_perl/Test/Builder/Formatter.pm"},{"path":"/usr/share/perl5/core_perl/Test/Builder/Module.pm"},{"path":"/usr/share/perl5/core_perl/Test/Builder/Tester.pm"},{"path":"/usr/share/perl5/core_perl/Test/Builder/TodoDiag.pm"},{"path":"/usr/share/perl5/core_perl/Test/Builder/Tester"},{"path":"/usr/share/perl5/core_perl/Test/Builder/Tester/Color.pm"},{"path":"/usr/share/perl5/core_perl/Test/Tester"},{"path":"/usr/share/perl5/core_perl/Test/Tester/Capture.pm"},{"path":"/usr/share/perl5/core_perl/Test/Tester/CaptureRunner.pm"},{"path":"/usr/share/perl5/core_perl/Test/Tester/Delegate.pm"},{"path":"/usr/share/perl5/core_perl/Test/use"},{"path":"/usr/share/perl5/core_perl/Test/use/ok.pm"},{"path":"/usr/share/perl5/core_perl/Test2"},{"path":"/usr/share/perl5/core_perl/Test2/API.pm"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Bundle.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Env.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Formatter.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Hub.pm"},{"path":"/usr/share/perl5/core_perl/Test2/IPC.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Mock.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Suite.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Todo.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util.pm"},{"path":"/usr/share/perl5/core_perl/Test2/V0.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API"},{"path":"/usr/share/perl5/core_perl/Test2/API/Breakage.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/Context.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/Instance.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/Stack.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult/Event.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult/Facet.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult/Hub.pm"},{"path":"/usr/share/perl5/core_perl/Test2/API/InterceptResult/Squasher.pm"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest/Formatter.pm"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest/Hub.pm"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest/Event"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest/Event/Attach.pm"},{"path":"/usr/share/perl5/core_perl/Test2/AsyncSubtest/Event/Detach.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Bundle"},{"path":"/usr/share/perl5/core_perl/Test2/Bundle/Extended.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Bundle/More.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Bundle/Simple.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Array.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Bag.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Base.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Bool.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Custom.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/DeepRef.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Delta.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Event.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/EventMeta.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Float.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Hash.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Isa.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Meta.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Negatable.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Number.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Object.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/OrderedSubset.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Pattern.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Ref.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Regex.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Scalar.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Set.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/String.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Undef.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Compare/Wildcard.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Bail.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Diag.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Encoding.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Exception.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Fail.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Generic.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Note.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Ok.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Pass.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Plan.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Skip.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Subtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/V2.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/Waiting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Event/TAP"},{"path":"/usr/share/perl5/core_perl/Test2/Event/TAP/Version.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/About.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Amnesty.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Assert.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Control.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Error.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Hub.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Info.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Meta.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Parent.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Plan.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Render.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Trace.pm"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Info"},{"path":"/usr/share/perl5/core_perl/Test2/EventFacet/Info/Table.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Formatter"},{"path":"/usr/share/perl5/core_perl/Test2/Formatter/TAP.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Hub"},{"path":"/usr/share/perl5/core_perl/Test2/Hub/Interceptor.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Hub/Subtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Hub/Interceptor"},{"path":"/usr/share/perl5/core_perl/Test2/Hub/Interceptor/Terminator.pm"},{"path":"/usr/share/perl5/core_perl/Test2/IPC"},{"path":"/usr/share/perl5/core_perl/Test2/IPC/Driver.pm"},{"path":"/usr/share/perl5/core_perl/Test2/IPC/Driver"},{"path":"/usr/share/perl5/core_perl/Test2/IPC/Driver/Files.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Concurrency.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Contributing.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/API.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/Context.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/EndToEnd.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/Event.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/Hubs.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/IPC.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Anatomy/Utilities.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing/Introduction.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing/Migrating.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing/Planning.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Testing/Todo.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/FirstTool.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Formatter.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Nesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Subtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/TestBuilder.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Testing.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Plugin"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Plugin/TestExit.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Plugin/TestingDone.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Plugin/ToolCompletes.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Manual/Tooling/Plugin/ToolStarts.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/BailOnFail.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/DieOnFail.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/ExitSummary.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/SRand.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/Times.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Plugin/UTF8.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require"},{"path":"/usr/share/perl5/core_perl/Test2/Require/AuthorTesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/AutomatedTesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/EnvVar.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/ExtendedTesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/Fork.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/Module.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/NonInteractiveTesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/Perl.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/RealFork.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/ReleaseTesting.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Require/Threads.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/AsyncSubtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Basic.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Class.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/ClassicCompare.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Compare.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Defer.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Encoding.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Event.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Exception.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Exports.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/GenTemp.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Grab.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Mock.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Ref.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Refcount.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Spec.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Subtest.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Target.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Tester.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Tiny.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Tools/Warnings.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util"},{"path":"/usr/share/perl5/core_perl/Test2/Util/ExternalMeta.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Facets2Legacy.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Grabber.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Guard.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/HashBase.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Importer.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Ref.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Sig.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Stash.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Sub.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Table.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Term.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Times.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Trace.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Table"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Table/Cell.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Util/Table/LineBreak.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/BlockBase.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Build.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Runner.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Task.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Task"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Task/Action.pm"},{"path":"/usr/share/perl5/core_perl/Test2/Workflow/Task/Group.pm"},{"path":"/usr/share/perl5/core_perl/Text"},{"path":"/usr/share/perl5/core_perl/Text/Abbrev.pm"},{"path":"/usr/share/perl5/core_perl/Text/Balanced.pm"},{"path":"/usr/share/perl5/core_perl/Text/ParseWords.pm"},{"path":"/usr/share/perl5/core_perl/Text/Tabs.pm"},{"path":"/usr/share/perl5/core_perl/Text/Wrap.pm"},{"path":"/usr/share/perl5/core_perl/Thread"},{"path":"/usr/share/perl5/core_perl/Thread/Queue.pm"},{"path":"/usr/share/perl5/core_perl/Thread/Semaphore.pm"},{"path":"/usr/share/perl5/core_perl/Tie"},{"path":"/usr/share/perl5/core_perl/Tie/Array.pm"},{"path":"/usr/share/perl5/core_perl/Tie/File.pm"},{"path":"/usr/share/perl5/core_perl/Tie/Handle.pm"},{"path":"/usr/share/perl5/core_perl/Tie/Hash.pm"},{"path":"/usr/share/perl5/core_perl/Tie/Memoize.pm"},{"path":"/usr/share/perl5/core_perl/Tie/RefHash.pm"},{"path":"/usr/share/perl5/core_perl/Tie/Scalar.pm"},{"path":"/usr/share/perl5/core_perl/Tie/StdHandle.pm"},{"path":"/usr/share/perl5/core_perl/Tie/SubstrHash.pm"},{"path":"/usr/share/perl5/core_perl/Tie/Hash"},{"path":"/usr/share/perl5/core_perl/Tie/Hash/NamedCapture.pm"},{"path":"/usr/share/perl5/core_perl/Time"},{"path":"/usr/share/perl5/core_perl/Time/Local.pm"},{"path":"/usr/share/perl5/core_perl/Time/gmtime.pm"},{"path":"/usr/share/perl5/core_perl/Time/localtime.pm"},{"path":"/usr/share/perl5/core_perl/Time/tm.pm"},{"path":"/usr/share/perl5/core_perl/Unicode"},{"path":"/usr/share/perl5/core_perl/Unicode/UCD.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/allkeys.txt"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/keys.txt"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/Big5.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/GB2312.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/JISX0208.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/Korean.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/Pinyin.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/Stroke.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/CJK/Zhuyin.pm"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/af.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ar.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/as.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/az.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/be.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/bn.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ca.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/cs.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/cu.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/cy.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/da.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/de_at_ph.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/de_phone.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/dsb.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ee.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/eo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/es.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/es_trad.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/et.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fa.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fi.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fi_phone.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fil.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/fr_ca.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/gu.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ha.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/haw.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/he.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/hi.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/hr.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/hu.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/hy.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ig.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/is.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ja.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/kk.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/kl.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/kn.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ko.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/kok.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/lkt.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ln.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/lt.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/lv.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/mk.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ml.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/mr.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/mt.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/nb.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/nn.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/nso.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/om.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/or.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/pa.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/pl.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ro.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sa.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/se.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/si.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/si_dict.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sk.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sl.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sq.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sr.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sv.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/sv_refo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ta.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/te.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/th.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/tn.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/to.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/tr.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ug_cyrl.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/uk.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/ur.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/vi.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/vo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/wae.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/wo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/yo.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh_big5.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh_gb.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh_pin.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh_strk.pl"},{"path":"/usr/share/perl5/core_perl/Unicode/Collate/Locale/zh_zhu.pl"},{"path":"/usr/share/perl5/core_perl/User"},{"path":"/usr/share/perl5/core_perl/User/grent.pm"},{"path":"/usr/share/perl5/core_perl/User/pwent.pm"},{"path":"/usr/share/perl5/core_perl/autodie"},{"path":"/usr/share/perl5/core_perl/autodie/Util.pm"},{"path":"/usr/share/perl5/core_perl/autodie/exception.pm"},{"path":"/usr/share/perl5/core_perl/autodie/hints.pm"},{"path":"/usr/share/perl5/core_perl/autodie/skip.pm"},{"path":"/usr/share/perl5/core_perl/autodie/Scope"},{"path":"/usr/share/perl5/core_perl/autodie/Scope/Guard.pm"},{"path":"/usr/share/perl5/core_perl/autodie/Scope/GuardStack.pm"},{"path":"/usr/share/perl5/core_perl/autodie/exception"},{"path":"/usr/share/perl5/core_perl/autodie/exception/system.pm"},{"path":"/usr/share/perl5/core_perl/encoding"},{"path":"/usr/share/perl5/core_perl/encoding/warnings.pm"},{"path":"/usr/share/perl5/core_perl/overload"},{"path":"/usr/share/perl5/core_perl/overload/numbers.pm"},{"path":"/usr/share/perl5/core_perl/source"},{"path":"/usr/share/perl5/core_perl/source/encoding.pm"},{"path":"/usr/share/perl5/core_perl/unicore"},{"path":"/usr/share/perl5/core_perl/unicore/Blocks.txt"},{"path":"/usr/share/perl5/core_perl/unicore/CombiningClass.pl"},{"path":"/usr/share/perl5/core_perl/unicore/Decomposition.pl"},{"path":"/usr/share/perl5/core_perl/unicore/Name.pl"},{"path":"/usr/share/perl5/core_perl/unicore/Name.pm"},{"path":"/usr/share/perl5/core_perl/unicore/NamedSequences.txt"},{"path":"/usr/share/perl5/core_perl/unicore/SpecialCasing.txt"},{"path":"/usr/share/perl5/core_perl/unicore/TestNorm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/UCD.pl"},{"path":"/usr/share/perl5/core_perl/unicore/uni_keywords.pl"},{"path":"/usr/share/perl5/core_perl/unicore/version"},{"path":"/usr/share/perl5/core_perl/unicore/To"},{"path":"/usr/share/perl5/core_perl/unicore/To/Age.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Bc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Bmg.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Bpb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Bpt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Cf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Ea.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/EqUIdeo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/GCB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Gc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Hst.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Identif2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Identifi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/InCB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/InPC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/InSC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Isc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Jg.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Jt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Lb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Lc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFCQC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFDQC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFKCCF.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFKCQC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFKCSCF.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NFKDQC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Na1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/NameAlia.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Nt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Nv.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/PerlDeci.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/SB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Sc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Scx.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Tc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Uc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/Vo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/WB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/_PerlLB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/_PerlSCX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHCat.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHCore.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHDesc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHFVal.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHFunc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHHG.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHIFAO.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHJSesh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/To/kEHUniK.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/NA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V100.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V11.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V110.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V120.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V130.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V140.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V150.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V160.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V20.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V30.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V31.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V32.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V40.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V41.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V50.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V51.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V52.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V60.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V61.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V70.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V80.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Age/V90.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Alpha"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Alpha/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/AL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/AN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/B.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/BN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/CS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/EN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/ES.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/ET.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/L.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/NSM.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/ON.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/R.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bc/WS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/BidiC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/BidiC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/BidiM"},{"path":"/usr/share/perl5/core_perl/unicore/lib/BidiM/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Blk"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Blk/NB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bpt"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bpt/C.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bpt/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Bpt/O.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CE"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CE/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CI"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CI/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWCF"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWCF/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWCM"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWCM/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWKCF"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWKCF/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWL"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWL/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWT"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWT/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWU"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CWU/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Cased"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Cased/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/A.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/AL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/AR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/ATAR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/B.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/BR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/DB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/NK.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/NR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/OV.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ccc/VR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CompEx"},{"path":"/usr/share/perl5/core_perl/unicore/lib/CompEx/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/DI"},{"path":"/usr/share/perl5/core_perl/unicore/lib/DI/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dash"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dash/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dep"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dep/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dia"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dia/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Com.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Enc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Fin.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Font.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Init.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Iso.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Med.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Nar.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Nb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/NonCanon.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Sqr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Sub.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Sup.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Dt/Vert.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EBase"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EBase/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EComp"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EComp/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EPres"},{"path":"/usr/share/perl5/core_perl/unicore/lib/EPres/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea/A.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea/H.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea/Na.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ea/W.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Emoji"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Emoji/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ext"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ext/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/ExtPict"},{"path":"/usr/share/perl5/core_perl/unicore/lib/ExtPict/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/CN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/EX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/LV.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/LVT.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/PP.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/SM.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/V.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GCB/XX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/C.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Cf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Cn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/L.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/LC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Ll.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Lm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Lo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Lu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/M.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Mc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Me.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Mn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Nd.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Nl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/No.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/P.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Pc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Pd.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Pe.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Pf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Pi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Po.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Ps.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/S.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Sc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Sk.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Sm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/So.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Z.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Gc/Zs.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GrBase"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GrBase/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GrExt"},{"path":"/usr/share/perl5/core_perl/unicore/lib/GrExt/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hex"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hex/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hst"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hst/NA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hyphen"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Hyphen/T.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDCMContinue"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDCMContinue/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDCMStart"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDCMStart/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDS"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IDS/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdStatus"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdStatus/Allowed.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdStatus/Restrict.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/DefaultI.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Exclusio.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Inclusio.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/LimitedU.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/NotChara.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/NotNFKC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/NotXID.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Obsolete.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Recommen.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Technica.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/IdType/Uncommon.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ideo"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Ideo/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/10_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/11_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/12_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/12_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/13_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/14_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/15_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/15_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/16_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/2_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/2_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/3_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/3_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/3_2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/4_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/4_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/5_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/5_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/5_2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/6_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/6_1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/6_2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/6_3.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/7_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/8_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/In/9_0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InCB"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InCB/Consonan.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InCB/Extend.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InCB/Linker.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InCB/None.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/Bottom.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/BottomAn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/Left.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/LeftAndR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/NA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/Overstru.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/Right.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/Top.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/TopAndBo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/TopAndL2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/TopAndLe.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/TopAndRi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InPC/VisualOr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Avagraha.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Bindu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Cantilla.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona3.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona4.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona5.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona6.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona7.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona8.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consona9.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Consonan.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Geminati.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Invisibl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Nukta.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Number.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Other.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/PureKill.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Syllable.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/ToneMark.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Virama.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Visarga.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/Vowel.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/VowelDep.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/InSC/VowelInd.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Ain.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Alef.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Beh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Dal.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/FarsiYeh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Feh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Gaf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Hah.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/HanifiRo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Kaf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Lam.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/NoJoinin.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Noon.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Qaf.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Reh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Sad.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Seen.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Tah.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Waw.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jg/Yeh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/C.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/D.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/L.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/R.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/T.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Jt/U.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/AI.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/AK.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/AL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/AP.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/AS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/BA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/BB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/CJ.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/CL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/CM.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/CP.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/EX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/GL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/ID.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/IN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/IS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/NS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/NU.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/OP.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/PO.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/PR.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/QU.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/SA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/VI.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lb/XX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lower"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Lower/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/MCM"},{"path":"/usr/share/perl5/core_perl/unicore/lib/MCM/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Math"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Math/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFCQC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFCQC/M.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFCQC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFDQC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFDQC/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFDQC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKCQC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKCQC/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKCQC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKDQC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKDQC/N.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/NFKDQC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nt"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nt/Di.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nt/None.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nt/Nu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/0.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/10.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/100.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/10000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/100000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/11.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/12.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/13.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/14.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/15.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/16.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/17.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/18.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/19.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_16.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_3.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_4.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_6.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/1_8.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/20.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/200.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/2000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/20000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/2_3.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/3.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/30.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/300.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/3000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/30000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/3_16.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/3_4.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/4.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/40.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/400.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/4000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/40000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/5.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/50.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/500.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/5000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/50000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/6.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/60.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/600.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/6000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/60000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/7.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/70.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/700.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/7000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/70000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/8.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/80.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/800.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/8000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/80000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/9.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/90.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/900.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/9000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Nv/90000.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/PCM"},{"path":"/usr/share/perl5/core_perl/unicore/lib/PCM/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/PatSyn"},{"path":"/usr/share/perl5/core_perl/unicore/lib/PatSyn/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Alnum.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Assigned.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Blank.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Graph.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/PerlWord.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/PosixPun.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Print.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/SpacePer.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Title.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/Word.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/XPosixPu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlAny.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlCh2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlCha.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlFol.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlIDC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlIDS.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlIsI.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlNch.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlPat.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlPr2.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlPro.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Perl/_PerlQuo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/QMark"},{"path":"/usr/share/perl5/core_perl/unicore/lib/QMark/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/AT.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/CL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/EX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/FO.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/LE.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/LO.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/NU.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/SC.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/ST.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/Sp.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/UP.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SB/XX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SD"},{"path":"/usr/share/perl5/core_perl/unicore/lib/SD/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/STerm"},{"path":"/usr/share/perl5/core_perl/unicore/lib/STerm/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Arab.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Armn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Beng.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Cprt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Cyrl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Deva.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Dupl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Ethi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Geor.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Glag.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Gong.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Gonm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Gran.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Grek.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Gujr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Guru.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Han.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Hang.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Hebr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Hira.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Kana.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Knda.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Latn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Limb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Linb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Mlym.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Mong.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Mult.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Mymr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Orya.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Sinh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Syrc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Taml.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Tang.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Telu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Tibt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Tutg.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Zinh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Sc/Zyyy.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Adlm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Aghb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Arab.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Armn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Avst.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Beng.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Bhks.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Bopo.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cakm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cari.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cham.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cher.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Copt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cprt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Cyrl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Deva.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Diak.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Dupl.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Ethi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Gara.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Geor.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Glag.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Gong.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Gonm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Goth.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Gran.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Grek.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Gujr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Guru.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Han.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hang.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hebr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hira.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hmng.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hmnp.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Hung.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Kana.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Khar.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Khmr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Khoj.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Knda.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Kthi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Lana.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Lao.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Latn.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Limb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Lina.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Linb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Lisu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Lydi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Mahj.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Mlym.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Mong.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Mult.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Mymr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Nand.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Nko.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Orya.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Osge.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Perm.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Phag.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Phlp.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Rohg.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Shrd.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Sind.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Sinh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Sunu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Syrc.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tagb.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Takr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tale.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Talu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Taml.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tang.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Telu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tfng.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Thaa.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Thai.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tibt.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tirh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Todr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Tutg.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Vith.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Xsux.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Yezi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Yi.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Zinh.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Zyyy.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Scx/Zzzz.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Term"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Term/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/UIdeo"},{"path":"/usr/share/perl5/core_perl/unicore/lib/UIdeo/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Upper"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Upper/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/VS"},{"path":"/usr/share/perl5/core_perl/unicore/lib/VS/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Vo"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Vo/R.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Vo/Tr.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Vo/Tu.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/Vo/U.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/EX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/Extend.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/FO.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/HL.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/KA.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/LE.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/MB.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/ML.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/MN.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/NU.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/WSegSpac.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/WB/XX.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/XIDC"},{"path":"/usr/share/perl5/core_perl/unicore/lib/XIDC/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/XIDS"},{"path":"/usr/share/perl5/core_perl/unicore/lib/XIDS/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/kEHNoMirror"},{"path":"/usr/share/perl5/core_perl/unicore/lib/kEHNoMirror/Y.pl"},{"path":"/usr/share/perl5/core_perl/unicore/lib/kEHNoRotate"},{"path":"/usr/share/perl5/core_perl/unicore/lib/kEHNoRotate/Y.pl"},{"path":"/usr/share/perl5/core_perl/version"},{"path":"/usr/share/perl5/core_perl/version/regex.pm"},{"path":"/usr/share/perl5/core_perl/warnings"},{"path":"/usr/share/perl5/core_perl/warnings/register.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"perl"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:perl:perl:*:*:*:*:*:perl:*:*"],"vulnerabilityID":"CVE-2026-15534","versionConstraint":"<= 5.45.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:perl:perl:5.42.3:*:*:*:*:*:*:*"],"package":{"name":"perl","version":"5.42.3-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-11-13","epss":0.00164,"percentile":0.05716}],"risk":0.08774000000000001,"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-13","epss":0.00186,"percentile":0.08311}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-13","epss":0.00186,"percentile":0.08311}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-13","epss":0.00186,"percentile":0.08311}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-13","epss":0.00186,"percentile":0.08311}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119372","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-13","epss":0.00147,"percentile":0.04011}],"risk":0.0819525,"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-13","epss":0.00256,"percentile":0.17396}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"risk":0.06898499999999999,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"risk":0.06898499999999999,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"risk":0.06898499999999999,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"risk":0.06898499999999999,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-114467","date":"2026-11-13","epss":0.00219,"percentile":0.12567}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-13","epss":0.00131,"percentile":0.02768}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-13","epss":0.00131,"percentile":0.02768}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-13","epss":0.00131,"percentile":0.02768}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-13","epss":0.00131,"percentile":0.02768}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116303","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116303","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116303","date":"2026-11-13","epss":0.00221,"percentile":0.12741}],"risk":0.067405,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116303"},"relatedVulnerabilities":[{"id":"CVE-2026-116303","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"epss":[{"cve":"CVE-2026-116303","date":"2026-11-13","epss":0.00221,"percentile":0.12741}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116303/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116303","description":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others.  A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found.  There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100407","versionConstraint":">= 2.44.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100407","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100407","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100407","date":"2026-11-13","epss":0.00117,"percentile":0.01679}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100407","description":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100408","versionConstraint":">= 2.43.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100408","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100408","date":"2026-11-13","epss":0.00117,"percentile":0.01679}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100408","description":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119377","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-13","epss":0.00129,"percentile":0.02554}],"risk":0.03612,"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"0d10613d64999df7","cpes":["cpe:2.3:a:git-perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_perl:git_perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-perl:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_perl:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-perl","purl":"pkg:apk/alpine/git-perl@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git-archimport"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/fsmonitor-watchman.sample"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"6a486dba123eb43d","cpes":["cpe:2.3:a:perl-git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl-git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl_git:perl_git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"perl-git","purl":"pkg:apk/alpine/perl-git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/perl5"},{"path":"/usr/share/perl5/vendor_perl"},{"path":"/usr/share/perl5/vendor_perl/Git.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/FromCPAN/Mail/Address.pm"},{"path":"/usr/share/perl5/vendor_perl/Git"},{"path":"/usr/share/perl5/vendor_perl/Git/I18N.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/IndexInfo.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/Packet.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Error.pm"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail"},{"path":"/usr/share/perl5/vendor_perl/Git/LoadCPAN/Mail/Address.pm"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:2f4bf7984fcf8b6ad154f67a488f41c91d74bfe1ce89439d79cf4fdad65452ec","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T08:53:20.060Z","grype_db_version":"2026-11-14T06:19:25.000Z"}