{"grype_matches":[{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"risk":1.7445,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-08","epss":0.02326,"percentile":0.82985}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4337","versionConstraint":"<1.24.13||>=1.25.0-0,<1.25.7||>=1.26.0-rc.1,<1.26.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4337","fix":{"state":"fixed","versions":["1.24.13","1.25.7","1.26.0-rc.3"],"available":[{"date":"2026-02-04","kind":"release","version":"1.24.13"},{"date":"2026-02-04","kind":"release","version":"1.25.7"},{"date":"2026-02-04","kind":"release","version":"1.26.0-rc.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-08","epss":0.00915,"percentile":0.58934}],"risk":0.8692500000000001,"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-68121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-08","epss":0.00915,"percentile":0.58934}],"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217","https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","https://pkg.go.dev/vuln/GO-2026-4337"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-49261","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-49261","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"risk":0.8455,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-49261"},"relatedVulnerabilities":[{"id":"CVE-2026-49261","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-49261","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-49261","date":"2026-10-08","epss":0.01691,"percentile":0.76385}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-3p3m-4x7c-p4pw","https://jira.mariadb.org/browse/MDEV-39721","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/errata/RHSA-2026:52848","https://access.redhat.com/errata/RHSA-2026:54142","https://access.redhat.com/security/cve/CVE-2026-49261","https://bugzilla.redhat.com/show_bug.cgi?id=2487957","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-49261.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-49261","description":"MariaDB server is a community developed fork of MySQL server. Versions 10.6.1 through 10.6.26, 10.11.1 through 10.11.17, 11.4.1 through 11.4.11, 11.8.1 through 11.8.7, and 12.3.1 with  `wsrep_notify_cmd` enabled would execute shell commands embedded in the name of the joiner node. This is fixed in 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2. As a workaround, anyone who cannot upgrade now should disable `wsrep_notify_cmd`."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48165","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48165","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48165"},"relatedVulnerabilities":[{"id":"CVE-2026-48165","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48165","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48165","date":"2026-10-08","epss":0.01602,"percentile":0.7508}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-7v3p-h23x-8hwv","https://jira.mariadb.org/browse/MDEV-39676","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48165","https://bugzilla.redhat.com/show_bug.cgi?id=2488458","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48165.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48165","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, a high-privileged MariaDB user could've used wsrep_sst_receive_address or wsrep_sst_donor global system variables to execute shell commands as the uid of the mariadbd process on the galera joiner node. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63076","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63076","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"risk":0.8009999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63076"},"relatedVulnerabilities":[{"id":"CVE-2026-63076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63076","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63076","date":"2026-10-08","epss":0.01602,"percentile":0.75073}],"urls":["https://github.com/openssl/openssl/commit/37882aa2e0256e1072442a8f62f7db45b995c45b","https://github.com/openssl/openssl/commit/a17cc8d612ecff6d94a9b7ca8b5283ddf5ff570e","https://github.com/openssl/openssl/commit/a1f348ccb328c3afbd4ba6883f9b7c813c043259","https://github.com/openssl/openssl/commit/a7af46a92d0ce19a90e669ef56d2576a07924226","https://github.com/openssl/openssl/commit/cdacfff557389abfa9e4615abded2ec984517d6c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63076","description":"Issue summary: OpenSSL CMP password based protection verification only\nchecks whether the protectionAlg parameter was not NULL and not its\nASN.1 type, before treating it as a PBMParameter. A crafted message can\ncontain a parameter of a different type, which is then dereferenced as an\ninvalid pointer.\n\nImpact summary: A remote, unauthenticated attacker can crash an application\nacting as a CMP server that accepts PBM-protected messages, or a CMP client\ntalking to a malicious or intercepted CMP server, resulting in a Denial of\nService.\n\nCWE: CWE-476: NULL Pointer Dereference\n\nDescription: When verifying the password-based MAC protection of a CMP\nmessage, OpenSSL library reads the protectionAlg algorithm parameter with\nX509_ALGOR_get0(), which returns both the parameter type and its value\npointer. The value is then cast to an ASN1_STRING and treated as the\nexpected PBMParameter after only checking that pointer is not NULL. The\nparameter type returned by X509_ALGOR_get0() was never consulted.\n\nThis happens during protection verification, before any MAC is computed, so\nno knowledge of the PBM shared secret is required; the only precondition is\nthat PBM verification is reachable. On the server side this is reached from\nOSSL_CMP_SRV_process_request() for any application that stands up a CMP\nserver accepting PBM-protected messages, and on the client side from CMP\nresponse validation against a malicious or on-path (MITM) server. The\nreliable consequence is a denial of service; there is no memory disclosure,\nno controlled memory write, and no path to code execution. CMP is a\nspecialized feature that an application must explicitly enable.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS modules\nare affected by this CVE."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4601","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4601","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-08","epss":0.00834,"percentile":0.56374}],"risk":0.6255000000000001,"urls":["https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/752180","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-25679","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-08","epss":0.00834,"percentile":0.56374}],"urls":["https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4601","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4981","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4981","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-08","epss":0.00813,"percentile":0.55713}],"risk":0.60975,"urls":["https://go.dev/cl/767860","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78803","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-33811","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-08","epss":0.00813,"percentile":0.55713}],"urls":["https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4981","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4977","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4977","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-08","epss":0.00798,"percentile":0.5517}],"risk":0.5984999999999999,"urls":["https://go.dev/cl/771520","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78987","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."},"relatedVulnerabilities":[{"id":"CVE-2026-42499","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-08","epss":0.00798,"percentile":0.5517}],"urls":["https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4977","https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4986","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4986","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-08","epss":0.00784,"percentile":0.54677}],"risk":0.588,"urls":["https://go.dev/cl/759940","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78566","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-39820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-08","epss":0.00784,"percentile":0.54677}],"urls":["https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4986","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4918","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-08","epss":0.00781,"percentile":0.54602}],"risk":0.58575,"urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/761581","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."},"relatedVulnerabilities":[{"id":"CVE-2026-33814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-08","epss":0.00781,"percentile":0.54602}],"urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"risk":0.5615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48163"},"relatedVulnerabilities":[{"id":"CVE-2026-48163","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":6.1,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-48163","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48163","date":"2026-10-08","epss":0.01123,"percentile":0.65226}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-rpgv-q6gv-684r","https://jira.mariadb.org/browse/MDEV-39648","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-48163","https://bugzilla.redhat.com/show_bug.cgi?id=2488454","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48163.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48163","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.27, 10.11.1 to before 10.11.18, 11.4.1 to before 11.4.12, 11.8.1 to before 11.8.8, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the rsync SST method. This issue has been patched in versions 10.6.27, 10.11.18, 11.4.12, 11.8.8, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5026","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-08","epss":0.00692,"percentile":0.51378}],"risk":0.5432199999999999,"urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/767220","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."},"relatedVulnerabilities":[{"id":"CVE-2026-39821","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-08","epss":0.00692,"percentile":0.51378}],"urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44172","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44172","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"risk":0.5205000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44172"},"relatedVulnerabilities":[{"id":"CVE-2026-44172","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44172","cwe":"CWE-89","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44172","date":"2026-10-08","epss":0.01041,"percentile":0.62947}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-pv9p-5w55-55jm","https://jira.mariadb.org/browse/CONC-819","https://access.redhat.com/errata/RHSA-2026:30135","https://access.redhat.com/errata/RHSA-2026:43505","https://access.redhat.com/errata/RHSA-2026:47772","https://access.redhat.com/errata/RHSA-2026:68567","https://access.redhat.com/security/cve/CVE-2026-44172","https://bugzilla.redhat.com/show_bug.cgi?id=2488459","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44172.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44172","description":"MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysql_real_escape_string() and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections, even though mysql_real_escape_string() was supposed to prevent them. This issue has been patched in versions 3.3.19 and 3.4.9."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4009","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4009","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-08","epss":0.00661,"percentile":0.50098}],"risk":0.49575,"urls":["https://go.dev/cl/709858","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75676","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.\n\nThis affects programs which parse untrusted PEM inputs."},"relatedVulnerabilities":[{"id":"CVE-2025-61723","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-08","epss":0.00661,"percentile":0.50098}],"urls":["https://go.dev/cl/709858","https://go.dev/issue/75676","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4009","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4006","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4006","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-08","epss":0.00647,"percentile":0.49441}],"risk":0.48525,"urls":["https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709860","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61725","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-08","epss":0.00647,"percentile":0.49441}],"urls":["https://go.dev/cl/709860","https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4006","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44168","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44168","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44168"},"relatedVulnerabilities":[{"id":"CVE-2026-44168","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44168","cwe":"CWE-78","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44168","date":"2026-10-08","epss":0.0097,"percentile":0.60741}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-vwf7-w26c-9w5h","https://jira.mariadb.org/browse/MDEV-39413","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44168","https://bugzilla.redhat.com/show_bug.cgi?id=2488450","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44168.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44168","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, during the SST the donor node is interpolating parameters that the joiner sent into the command line. Not all parameters were properly validated which could allow a malicious joiner to execute arbitrary shell commands on the donor side via the mariabackup SST method. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4870","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4870","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-08","epss":0.00621,"percentile":0.48175}],"risk":0.46575,"urls":["https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763767","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3."},"relatedVulnerabilities":[{"id":"CVE-2026-32283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-08","epss":0.00621,"percentile":0.48175}],"urls":["https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4870","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4971","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4971","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-08","epss":0.0062,"percentile":0.48083}],"risk":0.46499999999999997,"urls":["https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://go.dev/cl/775320"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79006","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."},"relatedVulnerabilities":[{"id":"CVE-2026-39836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-08","epss":0.0062,"percentile":0.48083}],"urls":["https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4971"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39836","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4947","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4947","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-08","epss":0.00615,"percentile":0.47829}],"risk":0.46125000000000005,"urls":["https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758320","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."},"relatedVulnerabilities":[{"id":"CVE-2026-32280","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-08","epss":0.00615,"percentile":0.47829}],"urls":["https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4947","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-10-08","epss":0.00916,"percentile":0.58982}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5037","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5037","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-08","epss":0.00591,"percentile":0.46588}],"risk":0.4432500000000001,"urls":["https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/783621","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname.\n\nWith a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."},"relatedVulnerabilities":[{"id":"CVE-2026-27145","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-08","epss":0.00591,"percentile":0.46588}],"urls":["https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5037","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4342","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4342","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-08","epss":0.00749,"percentile":0.53509}],"risk":0.430675,"urls":["https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736713","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."},"relatedVulnerabilities":[{"id":"CVE-2025-61728","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-08","epss":0.00749,"percentile":0.53509}],"urls":["https://go.dev/cl/736713","https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4342","http://www.openwall.com/lists/oss-security/2026/01/15/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6089","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6089","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-08","epss":0.00568,"percentile":0.45315}],"risk":0.426,"urls":["https://go.dev/cl/795540","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80205","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."},"relatedVulnerabilities":[{"id":"CVE-2026-56853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-08","epss":0.00568,"percentile":0.45315}],"urls":["https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6090","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6090","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-08","epss":0.00568,"percentile":0.45315}],"risk":0.426,"urls":["https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80528","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-56862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-08","epss":0.00568,"percentile":0.45315}],"urls":["https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5972","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5972","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-08","epss":0.00568,"percentile":0.45314}],"risk":0.426,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814980"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80405","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."},"relatedVulnerabilities":[{"id":"CVE-2026-33818","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-08","epss":0.00568,"percentile":0.45314}],"urls":["https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6088","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6088","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-08","epss":0.00568,"percentile":0.45314}],"risk":0.426,"urls":["https://go.dev/cl/803320","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80481","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-56859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-08","epss":0.00568,"percentile":0.45314}],"urls":["https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6088"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44173","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44173","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"risk":0.422,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44173"},"relatedVulnerabilities":[{"id":"CVE-2026-44173","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:L","metrics":{"baseScore":5,"impactScore":1.5,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44173","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-44173","cwe":"CWE-266","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-44173","date":"2026-10-08","epss":0.00844,"percentile":0.56673}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-667j-m53j-wpmc","https://jira.mariadb.org/browse/MDEV-39493","https://access.redhat.com/errata/RHSA-2026:25143","https://access.redhat.com/errata/RHSA-2026:25145","https://access.redhat.com/errata/RHSA-2026:33093","https://access.redhat.com/errata/RHSA-2026:33412","https://access.redhat.com/errata/RHSA-2026:33464","https://access.redhat.com/errata/RHSA-2026:33481","https://access.redhat.com/errata/RHSA-2026:33482","https://access.redhat.com/errata/RHSA-2026:49522","https://access.redhat.com/security/cve/CVE-2026-44173","https://bugzilla.redhat.com/show_bug.cgi?id=2488460","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44173.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44173","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, MariaDB allowed SELECT ... INTO OUTFILE and SELECT ... INTO DUMPFILE without verifying the FILE privilege if the FROM clause contained only subqueries. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5038","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5038","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-08","epss":0.0056,"percentile":0.44869}],"risk":0.42,"urls":["https://go.dev/cl/774481","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79217","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-42504","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-08","epss":0.0056,"percentile":0.44869}],"urls":["https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5038"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-32710","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-32710","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"risk":0.40099999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-32710"},"relatedVulnerabilities":[{"id":"CVE-2026-32710","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32710","cwe":"CWE-122","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-32710","date":"2026-10-08","epss":0.00802,"percentile":0.55349}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-4rj5-2227-9wgc","https://jira.mariadb.org/browse/MDEV-38356"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32710","description":"MariaDB server is a community developed fork of MySQL server. An authenticated user can crash MariaDB versions 11.4 before 11.4.10 and 11.8 before 11.8.6 via a bug in JSON_SCHEMA_VALID() function. Under certain conditions it might be possible to turn the crash into a remote code execution. These conditions require tight control over memory layout which is generally only attainable in a lab environment. This issue is fixed in MariaDB 11.4.10, MariaDB 11.8.6, and MariaDB 12.2.2."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70459","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70459","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-08","epss":0.00721,"percentile":0.52523}],"risk":0.3605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70459"},"relatedVulnerabilities":[{"id":"CVE-2026-70459","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-08","epss":0.00721,"percentile":0.52523}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m","https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459","description":"rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4155","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4155","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-08","epss":0.00457,"percentile":0.37641}],"risk":0.34275,"urls":["https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/725920","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-08","epss":0.00457,"percentile":0.37641}],"urls":["https://go.dev/cl/725920","https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4155"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."}]},{"artifact":{"id":"813f0a154029aae4","cpes":["cpe:2.3:a:libgcrypt20:libgcrypt20:1.10.3-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libgcrypt20","purl":"pkg:deb/ubuntu/libgcrypt20@1.10.3-2ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.10.3-2ubuntu0.1","language":"","licenses":["sha256:40162167dff80843a4b24aa8d0a4ffc50be5338d004ebe38f86ae3397ba9de3e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgcrypt20/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libgcrypt20/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.10.3-2ubuntu0.2"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2236","versionConstraint":"< 1.10.3-2ubuntu0.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libgcrypt20","version":"1.10.3-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-2236","fix":{"state":"fixed","versions":["1.10.3-2ubuntu0.2"],"available":[{"date":"2026-09-01","kind":"advisory","version":"1.10.3-2ubuntu0.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-10-08","epss":0.01114,"percentile":0.65005}],"risk":0.3342,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2236"},"relatedVulnerabilities":[{"id":"CVE-2024-2236","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-10-08","epss":0.01114,"percentile":0.65005}],"urls":["https://access.redhat.com/errata/RHSA-2024:9404","https://access.redhat.com/errata/RHSA-2025:3530","https://access.redhat.com/errata/RHSA-2025:3534","https://access.redhat.com/security/cve/CVE-2024-2236","https://bugzilla.redhat.com/show_bug.cgi?id=2245218","https://bugzilla.redhat.com/show_bug.cgi?id=2268268"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60082","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-08","epss":0.00653,"percentile":0.4974}],"risk":0.3265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60082"},"relatedVulnerabilities":[{"id":"CVE-2026-60082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-08","epss":0.00653,"percentile":0.4974}],"urls":["https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvg","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.643-4ubuntu0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-73193","versionConstraint":"< 1.643-4ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73193","fix":{"state":"fixed","versions":["1.643-4ubuntu0.3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"1.643-4ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-73193","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-73193","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-73193","date":"2026-10-08","epss":0.00649,"percentile":0.49542}],"risk":0.3245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73193"},"relatedVulnerabilities":[{"id":"CVE-2026-73193","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73193","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-73193","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-73193","date":"2026-10-08","epss":0.00649,"percentile":0.49542}],"urls":["https://github.com/perl5-dbi/dbi/commit/c751ae5a5a6f56c2f8284f37c1f4d43500352ef1.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wj3v-c3hh-mhqr","https://www.cve.org/CVERecord?id=CVE-2026-14739"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73193","description":"DBI versions before 1.652 for Perl allow a heap out-of-bounds write on 32-bit perl via an integer wraparound in the output buffer size computed by preparse.\n\npreparse reserves its output buffer with `newSV(strlen(statement) * 7 + 16)`, budgeting seven output bytes per input byte for the longest ':p99999' expansion. The product is computed in STRLEN, which is 32 bits wide on a 32-bit perl build, so a statement of 613,566,757 bytes multiplies to 4,294,967,299, wraps modulo 2^32 to 3, and reserves 19 bytes. The parser then copies the statement out through a raw pointer with no capacity check, writing the whole 585 MB input past the end of the allocation. The 99,999 placeholder limit does not bound this path, which is reached by ordinary non-placeholder content.\n\nAny caller that passes an untrusted statement of that length to preparse on a 32-bit perl gets a heap out-of-bounds write of attacker controlled bytes. Builds with a 64-bit STRLEN are not affected, since the wrap there needs a statement of about 2.3 exabytes."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-08","epss":0.0063,"percentile":0.48579}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-08","epss":0.0063,"percentile":0.48561}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60081"},"relatedVulnerabilities":[{"id":"CVE-2026-60081","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-08","epss":0.0063,"percentile":0.48561}],"urls":["https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60081","description":"DBI::ProfileData versions before 1.651 for Perl do not limit the path index.\n\nThe path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53790","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-08","epss":0.00629,"percentile":0.48506}],"risk":0.3145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53790"},"relatedVulnerabilities":[{"id":"CVE-2026-53790","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-08","epss":0.00629,"percentile":0.48506}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq","https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","description":"rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88816","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-88816","date":"2026-10-08","epss":0.00622,"percentile":0.48189}],"risk":0.311,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88816"},"relatedVulnerabilities":[{"id":"CVE-2026-88816","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88816","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-88816","date":"2026-10-08","epss":0.00622,"percentile":0.48189}],"urls":["https://github.com/perl5-dbi/dbi/commit/70962570212dc60a5428098cf2a0462ad5945851.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-f4qx-mr9m-q2hq","https://metacpan.org/release/HMBRAND/DBI-1.654/changes","http://www.openwall.com/lists/oss-security/2026/09/28/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88816","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in FetchHashKeyName.\n\nfetchrow_hashref uses the string pointer of the FetchHashKeyName attribute as the key name without stringifying it first. When FetchHashKeyName has been set to an integer (IV) or floating-point (NV) value, that pointer is invalid, so reading the key name triggers a segmentation fault.\n\nThis can be triggered with the following code:\n\n   my $dbh = DBI->connect( \"dbi:ExampleP:\", \"\", \"\",\n       { RaiseError => 0, PrintError => 0 } );\n   $dbh->{FetchHashKeyName} = 42;\n\n   my $sth = $dbh->prepare(\"select mode, size, name from .\");\n   $sth->execute;\n   $sth->fetchrow_hashref;"}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4007","versionConstraint":"<1.24.9||>=1.25.0,<1.25.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4007","fix":{"state":"fixed","versions":["1.24.9","1.25.3"],"available":[{"date":"2025-10-13","kind":"release","version":"1.24.9"},{"date":"2025-10-13","kind":"release","version":"1.25.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-08","epss":0.00406,"percentile":0.32778}],"risk":0.3045,"urls":["https://go.dev/cl/709854","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75681","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58187","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-08","epss":0.00406,"percentile":0.32778}],"urls":["https://go.dev/cl/709854","https://go.dev/issue/75681","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4007","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"risk":0.3045,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-08","epss":0.00609,"percentile":0.47546}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6218","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6218","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-08","epss":0.0055,"percentile":0.44284}],"risk":0.29975,"urls":["https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/803681","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-56860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-08","epss":0.0055,"percentile":0.44284}],"urls":["https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6218"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.13-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.16"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.13-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.2925,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"< 3.0.13-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.16"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.13-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"risk":0.2925,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-10-08","epss":0.0039,"percentile":0.31045}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4012","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4012","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-08","epss":0.00565,"percentile":0.45157}],"risk":0.290975,"urls":["https://go.dev/cl/709855","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75672","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-58186","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-08","epss":0.00565,"percentile":0.45157}],"urls":["https://go.dev/cl/709855","https://go.dev/issue/75672","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4012","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70464","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-08","epss":0.00573,"percentile":0.45604}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70464"},"relatedVulnerabilities":[{"id":"CVE-2026-70464","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-08","epss":0.00573,"percentile":0.45604}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m","https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","description":"rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4011","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4011","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-08","epss":0.00556,"percentile":0.44609}],"risk":0.28634,"urls":["https://go.dev/cl/709856","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75671","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2025-58185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-08","epss":0.00556,"percentile":0.44609}],"urls":["https://go.dev/cl/709856","https://go.dev/issue/75671","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4011","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4015","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4015","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-08","epss":0.00556,"percentile":0.44609}],"risk":0.28634,"urls":["https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709859","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61724","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-08","epss":0.00556,"percentile":0.44609}],"urls":["https://go.dev/cl/709859","https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4015","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4013","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4013","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-08","epss":0.00381,"percentile":0.30022}],"risk":0.28575,"urls":["https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709853","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-08","epss":0.00381,"percentile":0.30022}],"urls":["https://go.dev/cl/709853","https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4013","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-08","epss":0.0057,"percentile":0.45415}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70461"},"relatedVulnerabilities":[{"id":"CVE-2026-70461","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-08","epss":0.0057,"percentile":0.45415}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","description":"rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-08","epss":0.00566,"percentile":0.45223}],"risk":0.28300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70455"},"relatedVulnerabilities":[{"id":"CVE-2026-70455","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-08","epss":0.00566,"percentile":0.45223}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9","https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4946","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4946","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-08","epss":0.00355,"percentile":0.27185}],"risk":0.26625,"urls":["https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758061","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."},"relatedVulnerabilities":[{"id":"CVE-2026-32281","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-08","epss":0.00355,"percentile":0.27185}],"urls":["https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4946"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-08","epss":0.00525,"percentile":0.42712}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70453"},"relatedVulnerabilities":[{"id":"CVE-2026-70453","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-08","epss":0.00525,"percentile":0.42712}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv","https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","description":"rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-13699","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-13699","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"risk":0.26,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13699"},"relatedVulnerabilities":[{"id":"CVE-2025-13699","cvss":[{"type":"Secondary","source":"zdi-disclosures@trendmicro.com","vector":"CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7,"impactScore":5.9,"exploitabilityScore":1.1},"version":"3.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13699","cwe":"CWE-22","type":"Secondary","source":"zdi-disclosures@trendmicro.com"}],"epss":[{"cve":"CVE-2025-13699","date":"2026-10-08","epss":0.0052,"percentile":0.42319}],"urls":["https://jira.mariadb.org/browse/MDEV-37483","https://www.zerodayinitiative.com/advisories/ZDI-25-1025/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13699","description":"MariaDB mariadb-dump Utility Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MariaDB. Interaction with the mariadb-dump utility is required to exploit this vulnerability but attack vectors may vary depending on the implementation.\n\nThe specific flaw exists within the handling of view names. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27000."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53794","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-08","epss":0.00507,"percentile":0.4133}],"risk":0.2535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53794"},"relatedVulnerabilities":[{"id":"CVE-2026-53794","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-08","epss":0.00507,"percentile":0.4133}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964","https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53794","description":"rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53791","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-08","epss":0.00501,"percentile":0.40971}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53791"},"relatedVulnerabilities":[{"id":"CVE-2026-53791","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-08","epss":0.00501,"percentile":0.40971}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635","https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53791","description":"rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-08","epss":0.00499,"percentile":0.40821}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14380"},"relatedVulnerabilities":[{"id":"CVE-2026-14380","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-08","epss":0.00499,"percentile":0.40821}],"urls":["https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14380","description":"DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"risk":0.24750000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-08","epss":0.00495,"percentile":0.40582}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1.643-4ubuntu0.3"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-73194","versionConstraint":"< 1.643-4ubuntu0.3 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-73194","fix":{"state":"fixed","versions":["1.643-4ubuntu0.3"],"available":[{"date":"2026-09-29","kind":"advisory","version":"1.643-4ubuntu0.3"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-73194","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-73194","cwe":"CWE-1284","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-73194","date":"2026-10-08","epss":0.00493,"percentile":0.40362}],"risk":0.24650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-73194"},"relatedVulnerabilities":[{"id":"CVE-2026-73194","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-73194","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-73194","cwe":"CWE-1284","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-73194","date":"2026-10-08","epss":0.00493,"percentile":0.40362}],"urls":["https://github.com/perl5-dbi/dbi/commit/29b72ae7d2a8114a734a55840bf1c45b89207809.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-623j-hfpc-mrc4","https://www.cve.org/CVERecord?id=CVE-2026-10879","https://www.cve.org/CVERecord?id=CVE-2026-14739"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-73194","description":"DBI versions before 1.652 for Perl allow a heap out-of-bounds write via an unvalidated numeric placeholder that sets the binder counter in preparse.\n\npreparse reserves seven output bytes per input byte, the width of the longest ':p99999' expansion. The ':N' branch parses the number with `atoi(src)` and assigns it to the binder counter with no range check, so a statement containing ':2147483648' leaves the counter negative (-2147483648 with glibc, where atoi wraps). Each following '?' then expands through `sprintf(start, \":p%d\", idx++)` to ':p-2147483648', 14 bytes with the terminating NUL where the buffer budgets 7. The placeholder limit added in 1.650 tests the counter against 99,999, which a negative counter passes.\n\nAny caller that preparses an untrusted statement into ':pN' style placeholders gets a heap out-of-bounds write that grows with the number of '?' marks following the poisoned placeholder. The '?' and '%s' return styles compare the parsed number against the expected sequence and error out, and are unaffected."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-08","epss":0.00486,"percentile":0.39854}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-08","epss":0.00486,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4008","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4008","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-08","epss":0.00468,"percentile":0.38509}],"risk":0.24101999999999998,"urls":["https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/707776","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."},"relatedVulnerabilities":[{"id":"CVE-2025-58189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-08","epss":0.00468,"percentile":0.38509}],"urls":["https://go.dev/cl/707776","https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4008","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4010","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4010","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-08","epss":0.00468,"percentile":0.38509}],"risk":0.24101999999999998,"urls":["https://go.dev/cl/709857","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75678","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."},"relatedVulnerabilities":[{"id":"CVE-2025-47912","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-08","epss":0.00468,"percentile":0.38509}],"urls":["https://go.dev/cl/709857","https://go.dev/issue/75678","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4010","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-35549","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-35549","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-35549"},"relatedVulnerabilities":[{"id":"CVE-2026-35549","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-35549","cwe":"CWE-789","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-35549","date":"2026-10-08","epss":0.00463,"percentile":0.38179}],"urls":["https://jira.mariadb.org/browse/MDEV-38365"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-35549","description":"An issue was discovered in MariaDB Server before 11.4.10, 11.5.x through 11.8.x before 11.8.6, and 12.x before 12.2.2. If the caching_sha2_password authentication plugin is installed, and some user accounts are configured to use it, a large packet can crash the server because sha256_crypt_r uses alloca."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70452","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-08","epss":0.00462,"percentile":0.38071}],"risk":0.231,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70452"},"relatedVulnerabilities":[{"id":"CVE-2026-70452","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-08","epss":0.00462,"percentile":0.38071}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq","https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","description":"rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-08","epss":0.00452,"percentile":0.37269}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70462"},"relatedVulnerabilities":[{"id":"CVE-2026-70462","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-08","epss":0.00452,"percentile":0.37269}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64","https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462","description":"rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-08","epss":0.0045,"percentile":0.37095}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-08","epss":0.0045,"percentile":0.37093}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-08","epss":0.00448,"percentile":0.36971}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-08","epss":0.00448,"percentile":0.36918}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70460"},"relatedVulnerabilities":[{"id":"CVE-2026-70460","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-08","epss":0.00448,"percentile":0.36918}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x","https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70460","description":"rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4980","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4980","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-08","epss":0.00393,"percentile":0.31319}],"risk":0.21811499999999998,"urls":["https://go.dev/cl/771180","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78981","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."},"relatedVulnerabilities":[{"id":"CVE-2026-39826","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-08","epss":0.00393,"percentile":0.31319}],"urls":["https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4980"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-08","epss":0.00436,"percentile":0.35864}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-52968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2023-52968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-52968"},"relatedVulnerabilities":[{"id":"CVE-2023-52968","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-52968","cwe":"CWE-696","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2023-52968","date":"2026-10-08","epss":0.00432,"percentile":0.35548}],"urls":["https://jira.mariadb.org/browse/MDEV-32082"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-52968","description":"MariaDB Server 10.4 before 10.4.33, 10.5 before 10.5.24, 10.6 before 10.6.17, 10.7 through 10.11 before 10.11.7, 11.0 before 11.0.5, and 11.1 before 11.1.4 calls fix_fields_if_needed under mysql_derived_prepare when derived is not yet prepared, leading to a find_field_in_table crash."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"risk":0.216,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-10-08","epss":0.00432,"percentile":0.35531}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-08","epss":0.00428,"percentile":0.35069}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53798"},"relatedVulnerabilities":[{"id":"CVE-2026-53798","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-08","epss":0.00428,"percentile":0.35069}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hx7p-3gvv-pqgv","https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53798","description":"rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4976","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4976","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-08","epss":0.00413,"percentile":0.33451}],"risk":0.212695,"urls":["https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/770541","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."},"relatedVulnerabilities":[{"id":"CVE-2026-39825","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-08","epss":0.00413,"percentile":0.33451}],"urls":["https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4976"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5039","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5039","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-08","epss":0.00412,"percentile":0.33355}],"risk":0.21218,"urls":["https://go.dev/cl/777060","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79346","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."},"relatedVulnerabilities":[{"id":"CVE-2026-42507","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-08","epss":0.00412,"percentile":0.33355}],"urls":["https://go.dev/cl/777060","https://go.dev/issue/79346","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5039"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78030","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78030","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78030","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-78030","date":"2026-10-08","epss":0.00424,"percentile":0.34663}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78030"},"relatedVulnerabilities":[{"id":"CVE-2026-78030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78030","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-78030","date":"2026-10-08","epss":0.00424,"percentile":0.34663}],"urls":["https://github.com/perl5-dbi/dbi/commit/315c6ce703b8b3cbe9188062d9ec80730293554a.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-wqmw-wqwx-3fr7","https://metacpan.org/release/HMBRAND/DBI-1.653/changes","http://www.openwall.com/lists/oss-security/2026/09/19/4"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78030","description":"DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM.\n\nDBD::DBM passes the dbm_type and dbm_mldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename and does not consult @INC, so the attribute chooses the file that Perl loads and runs.\n\nThe MLDBM::Serializer:: prefix that DBD::DBM prepends to dbm_mldbm is not a boundary: only the :: separators are rewritten to /, so a value containing / traverses out of the serializer directory. The value is also assigned to $MLDBM::Serializer, which MLDBM requires the same way when it ties the table.\n\nA caller that lets an untrusted party influence either attribute, for example through a DSN fragment or a parameter that selects a storage backend, runs the file-scope code of whatever module the value names.\n\nFor example,\n\n    my $dsn = \"dbi:DBM:f_dir=/var/db;dbm_type=../../Untrusted.pm\"\n    my $dbh = DBI->connect( $dsn );\n\nNote that DBD::Gofer forwards connect attributes to the server side, and DBI::ProxyServer checks only that a DSN starts with a driver prefix."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34303","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-34303","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34303"},"relatedVulnerabilities":[{"id":"CVE-2026-34303","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34303","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-34303","date":"2026-10-08","epss":0.00422,"percentile":0.34556}],"urls":["https://www.oracle.com/security-alerts/cpuapr2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34303","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.45, 8.4.0-8.4.8 and  9.0.0-9.6.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-08","epss":0.00422,"percentile":0.34552}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"risk":0.209,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-10-08","epss":0.00418,"percentile":0.34114}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-08","epss":0.00416,"percentile":0.33877}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14739","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14739","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-08","epss":0.00413,"percentile":0.33525}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14739"},"relatedVulnerabilities":[{"id":"CVE-2026-14739","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-08","epss":0.00413,"percentile":0.33525}],"urls":["https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","https://www.cve.org/CVERecord?id=CVE-2026-10879"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-08","epss":0.00412,"percentile":0.33413}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-80489"},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-08","epss":0.00412,"percentile":0.33413}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-08","epss":0.00412,"percentile":0.33413}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-80489"},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-10-08","epss":0.00412,"percentile":0.33413}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-08","epss":0.00412,"percentile":0.33412}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77117"},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-08","epss":0.00412,"percentile":0.33412}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-08","epss":0.00412,"percentile":0.33412}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77117"},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-10-08","epss":0.00412,"percentile":0.33412}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4014","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4014","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-08","epss":0.00443,"percentile":0.36489}],"risk":0.20599499999999996,"urls":["https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709861","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."},"relatedVulnerabilities":[{"id":"CVE-2025-58183","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-08","epss":0.00443,"percentile":0.36489}],"urls":["https://go.dev/cl/709861","https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4014","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."}]},{"artifact":{"id":"84189c52cc07ec75","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-08","epss":0.00665,"percentile":0.50251}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-08","epss":0.00665,"percentile":0.50251}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53786","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53786","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-08","epss":0.00398,"percentile":0.31911}],"risk":0.199,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53786"},"relatedVulnerabilities":[{"id":"CVE-2026-53786","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-08","epss":0.00398,"percentile":0.31911}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6","https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786","description":"rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-08","epss":0.00396,"percentile":0.31728}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53795"},"relatedVulnerabilities":[{"id":"CVE-2026-53795","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-08","epss":0.00396,"percentile":0.31728}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq","https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795","description":"rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-08","epss":0.00396,"percentile":0.31644}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70456"},"relatedVulnerabilities":[{"id":"CVE-2026-70456","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-08","epss":0.00396,"percentile":0.31644}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","description":"rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70458","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-08","epss":0.00396,"percentile":0.31644}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70458"},"relatedVulnerabilities":[{"id":"CVE-2026-70458","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-08","epss":0.00396,"percentile":0.31644}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","description":"rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-08","epss":0.00394,"percentile":0.31423}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-08","epss":0.00394,"percentile":0.31423}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5856","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5856","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-08","epss":0.00382,"percentile":0.3011}],"risk":0.19673,"urls":["https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/775960","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."},"relatedVulnerabilities":[{"id":"CVE-2026-42505","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-08","epss":0.00382,"percentile":0.3011}],"urls":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-5856"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42505","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53793","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53793","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-08","epss":0.00393,"percentile":0.31359}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53793"},"relatedVulnerabilities":[{"id":"CVE-2026-53793","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-08","epss":0.00393,"percentile":0.31359}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44","https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793","description":"rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-14740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-08","epss":0.00387,"percentile":0.30632}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14740"},"relatedVulnerabilities":[{"id":"CVE-2026-14740","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-08","epss":0.00387,"percentile":0.30632}],"urls":["https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14740","description":"DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.\n\nThe preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15043","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-08","epss":0.00387,"percentile":0.30632}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15043"},"relatedVulnerabilities":[{"id":"CVE-2026-15043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-08","epss":0.00387,"percentile":0.30632}],"urls":["https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043","description":"DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4603","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4603","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-08","epss":0.00346,"percentile":0.26021}],"risk":0.19202999999999998,"urls":["https://go.dev/issue/77954","https://go.dev/cl/752081"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\".\n\nA new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."},"relatedVulnerabilities":[{"id":"CVE-2026-27142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-08","epss":0.00346,"percentile":0.26021}],"urls":["https://go.dev/cl/752081","https://go.dev/issue/77954","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4603"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70457","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-08","epss":0.00377,"percentile":0.29582}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70457"},"relatedVulnerabilities":[{"id":"CVE-2026-70457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-08","epss":0.00377,"percentile":0.29582}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70457","description":"rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-08","epss":0.00375,"percentile":0.2942}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-08","epss":0.00375,"percentile":0.29419}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-10-08","epss":0.00374,"percentile":0.29283}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53783","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-08","epss":0.00374,"percentile":0.2927}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53783"},"relatedVulnerabilities":[{"id":"CVE-2026-53783","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-08","epss":0.00374,"percentile":0.2927}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5","https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783","description":"rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-10-08","epss":0.00622,"percentile":0.48184}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3494","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-3494","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"risk":0.186,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3494"},"relatedVulnerabilities":[{"id":"CVE-2026-3494","cvss":[{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3494","cwe":"CWE-778","type":"Secondary","source":"ff89ba41-3aa1-4d27-914a-91399e9639e5"}],"epss":[{"cve":"CVE-2026-3494","date":"2026-10-08","epss":0.00372,"percentile":0.29104}],"urls":["https://aws.amazon.com/security/security-bulletins/2026-006-AWS/","https://github.com/MariaDB/server/commit/635559a2ad68a5a6d1a354e8209c58323dba0261","https://github.com/aws/audit-plugin-for-mysql/commit/01e25a5cb1073f131eea774c06c8a056b1e4b2ff"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3494","description":"In MariaDB server version through 11.8.5, when server audit plugin is enabled with server_audit_events variable configured with QUERY_DCL, QUERY_DDL, or QUERY_DML filtering, if an authenticated database user invokes a SQL statement prefixed with double-hyphen (—) or hash (#) style comments, the statement is not logged."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47064","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47064","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"risk":0.185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47064"},"relatedVulnerabilities":[{"id":"CVE-2026-47064","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47064","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47064","date":"2026-10-08","epss":0.0037,"percentile":0.28833}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47064","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4865","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4865","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-08","epss":0.00333,"percentile":0.24439}],"risk":0.18481499999999998,"urls":["https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763762","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2026-32289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-08","epss":0.00333,"percentile":0.24439}],"urls":["https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4865"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4982","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4982","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-08","epss":0.00333,"percentile":0.24439}],"risk":0.18481499999999998,"urls":["https://go.dev/cl/769920","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78913","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-39823","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-08","epss":0.00333,"percentile":0.24439}],"urls":["https://go.dev/cl/769920","https://go.dev/issue/78913","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4982"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39823","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70463","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70463","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-08","epss":0.00364,"percentile":0.28162}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70463"},"relatedVulnerabilities":[{"id":"CVE-2026-70463","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-08","epss":0.00364,"percentile":0.28162}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr","https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","description":"rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-08","epss":0.00359,"percentile":0.2755}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-08","epss":0.00359,"percentile":0.27549}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-08","epss":0.00359,"percentile":0.27548}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53789","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-08","epss":0.00357,"percentile":0.27404}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53789"},"relatedVulnerabilities":[{"id":"CVE-2026-53789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-08","epss":0.00357,"percentile":0.27404}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q","https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","description":"rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-10-08","epss":0.00357,"percentile":0.27366}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"ac4c65178408e21f","cpes":["cpe:2.3:a:zlib1g:zlib1g:1\\:1.3.dfsg-3.1ubuntu2.1:*:*:*:*:*:*:*"],"name":"zlib1g","purl":"pkg:deb/ubuntu/zlib1g@1%3A1.3.dfsg-3.1ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=zlib","type":"deb","version":"1:1.3.dfsg-3.1ubuntu2.1","language":"","licenses":["Zlib"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/zlib1g/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/zlib1g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/zlib1g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"zlib"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"zlib","version":"1:1.3.dfsg-3.1ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-85091","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"risk":0.178,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85091"},"relatedVulnerabilities":[{"id":"CVE-2026-85091","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85091","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-85091","date":"2026-10-08","epss":0.00356,"percentile":0.27225}],"urls":["https://gist.github.com/thesmartshadow/e0b9481792afb7c31e86fee1ff084490","https://github.com/madler/zlib","https://github.com/madler/zlib/blob/v1.3.2/gzwrite.c#L393","https://www.vulncheck.com/advisories/zlib-1.3.1.2-through-1.3.2-heap-buffer-overflow-via-gz-vacate"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85091","description":"zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vulnerability in the gz_vacate() function when processing non-blocking gzwrite() operations with stale external buffer pointers. Attackers can trigger the overflow by calling gzprintf() or gzvprintf() after a write stall, causing an unchecked memmove() to write beyond the internal input buffer boundary."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4970","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4970","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-08","epss":0.00232,"percentile":0.12958}],"risk":0.17748,"urls":["https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79005","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."},"relatedVulnerabilities":[{"id":"CVE-2026-39822","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-08","epss":0.00232,"percentile":0.12958}],"urls":["https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-4970"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63074","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"risk":0.1764,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63074"},"relatedVulnerabilities":[{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.15"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63074","versionConstraint":"< 3.0.13-0ubuntu3.15 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-63074","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.15"],"available":[{"date":"2026-08-25","kind":"advisory","version":"3.0.13-0ubuntu3.15"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"risk":0.1764,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63074"},"relatedVulnerabilities":[{"id":"CVE-2026-63074","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63074","cwe":"CWE-770","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63074","date":"2026-10-08","epss":0.00588,"percentile":0.46424}],"urls":["https://github.com/openssl/openssl/commit/01e567978a55fba18142a230380c31296049fae7","https://github.com/openssl/openssl/commit/21a5d9658b0c66daace60e10ea18ff32a448de9f","https://github.com/openssl/openssl/commit/74ae7f6df47a5767c1010b88c47507dfc5b32c46","https://github.com/openssl/openssl/commit/75360af9650d4e0c82ba0050c5c9912cd79e54af","https://github.com/openssl/openssl/commit/f636f9ca0fa1bae5b42f9e787f025c96fb09c43a","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63074","description":"Issue summary: The OpenSSL Certificate Management Protocol (CMP) caches\nadditional certificates (extraCerts) sent in a CMP message, but never expunges\nthem (for instance if they are invalid).  If a server reuses an OSSL_CMP_CTX\nfrequently, this cache of extraCerts may grow unboundedly, and a malicious\nclient may flood a CMP server with requests driving this growth.\n\nImpact summary: Users utilizing a CMP server that reuses a single OSSL_CMP_CTX\nfor the lifetime of a server process may observe unbounded memory growth in the\nevent a malicious client repeatedly sends requests containing unique extra\ncertificates, which may lead to OOM conditions.\n\nCWE: CWE-770: Allocation of Resources Without Limits or Throttling\n\nDescription: If a remote user sends CMP messages to a server with a list of\nextraCerts and the message is rejected, the extraCerts from the message remains\nin the server contexts untrusted certificate stack.  This exposes servers with\nlong lived ctx objects to Denial of Service attacks in which an attacker sends\nmessages intending to be rejected with a large list of additional certificates\nrepeatedly, forcing the server to store them indefinitely.\n   \nThe issue was fixed by removing the added extra certs if the message is\nrejected, using the same method as when the context is configured to not do\ncaching at all.\n\nFIPS impact: no\nAs the CMP code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53801","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-08","epss":0.00349,"percentile":0.26488}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53801"},"relatedVulnerabilities":[{"id":"CVE-2026-53801","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-08","epss":0.00349,"percentile":0.26488}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm","https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53801","description":"rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6091","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6091","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-08","epss":0.0031,"percentile":0.21812}],"risk":0.17204999999999998,"urls":["https://go.dev/cl/807100","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80435","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-56858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-08","epss":0.0031,"percentile":0.21812}],"urls":["https://go.dev/cl/807100","https://go.dev/issue/80435","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-08","epss":0.00342,"percentile":0.2561}],"risk":0.17099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-08","epss":0.00342,"percentile":0.2561}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-08","epss":0.00342,"percentile":0.2561}],"risk":0.17099999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-08","epss":0.00342,"percentile":0.2561}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4340","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4340","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-08","epss":0.00329,"percentile":0.23929}],"risk":0.169435,"urls":["https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/724120","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-61730","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-08","epss":0.00329,"percentile":0.23929}],"urls":["https://go.dev/cl/724120","https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4340"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4864","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4864","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-08","epss":0.00292,"percentile":0.19913}],"risk":0.16644,"urls":["https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763761","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."},"relatedVulnerabilities":[{"id":"CVE-2026-32282","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-08","epss":0.00292,"percentile":0.19913}],"urls":["https://go.dev/cl/763761","https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4864"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."}]},{"artifact":{"id":"3d2cf63ae2e37d1a","cpes":["cpe:2.3:a:diffutils:diffutils:1\\:3.10-1build1:*:*:*:*:*:*:*"],"name":"diffutils","purl":"pkg:deb/ubuntu/diffutils@1%3A3.10-1build1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1:3.10-1build1","language":"","licenses":["FSFAP","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2.0+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3.0+","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/diffutils/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/diffutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/diffutils.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/diffutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/diffutils.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/diffutils.list"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"1:3.10-1ubuntu0.1"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53910","versionConstraint":"< 1:3.10-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"diffutils","version":"1:3.10-1build1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53910","fix":{"state":"fixed","versions":["1:3.10-1ubuntu0.1"],"available":[{"date":"2026-08-31","kind":"advisory","version":"1:3.10-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-10-08","epss":0.00332,"percentile":0.24312}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53910"},"relatedVulnerabilities":[{"id":"CVE-2026-53910","cvss":[{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.1},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53910","cwe":"CWE-190","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-53910","date":"2026-10-08","epss":0.00332,"percentile":0.24312}],"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-53910","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=73ed7ce85cc78effb94daf028c9af6b4e5252e50","https://cgit.git.savannah.gnu.org/cgit/diffutils.git/commit/?id=9ff04d5b84743e331e80b589335a52c5480d1815","https://git.savannah.gnu.org/cgit/diffutils.git/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53910","description":"diff3 tool from GNU diffutils is vulnerable to a heap‑based buffer overflow due to multiple signed integer overflows in line‑mapping calculations. Incorrect arithmetic in mapping line ranges can result in corrupted values being used for memory allocation and loop bounds.\nWhen processing crafted diff output, these overflows may cause the application to allocate insufficient memory and subsequently perform out‑of‑bounds writes during internal processing. \nAn attacker who can control the output of the diff program used by diff3 (e.g. via --diff-program pointing to a malicious script) can trigger out-of-bounds writes, resulting in a crash and potentially remote code execution depending on the environment.\n\n\nThis issue has been fixed in commit 9ff04d5b84743e331e80b589335a52c5480d1815 \n\nNOTE:\nThe project maintainers claim that this is not a security issue. They state that the worst outcome this issue can cause is a crash of diff and that it cannot be used to escalate privileges."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-08","epss":0.00332,"percentile":0.24307}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-08","epss":0.00332,"percentile":0.24306}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4175","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4175","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-08","epss":0.00284,"percentile":0.1914}],"risk":0.1633,"urls":["https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/723900","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."},"relatedVulnerabilities":[{"id":"CVE-2025-61727","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-08","epss":0.00284,"percentile":0.1914}],"urls":["https://go.dev/cl/723900","https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4175"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-61081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61081"},"relatedVulnerabilities":[{"id":"CVE-2026-61081","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61081","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61081","date":"2026-10-08","epss":0.00323,"percentile":0.23272}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61081","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Performance Schema).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 2.7 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53792","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53792","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-08","epss":0.00311,"percentile":0.2193}],"risk":0.1555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53792"},"relatedVulnerabilities":[{"id":"CVE-2026-53792","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-08","epss":0.00311,"percentile":0.2193}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw","https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53792","description":"rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21968","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-21968","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"risk":0.1505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21968"},"relatedVulnerabilities":[{"id":"CVE-2026-21968","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21968","date":"2026-10-08","epss":0.00301,"percentile":0.20921}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21968","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-08","epss":0.00297,"percentile":0.20503}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19499"},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-08","epss":0.00297,"percentile":0.20503}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19499","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19499","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-08","epss":0.00297,"percentile":0.20503}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19499"},"relatedVulnerabilities":[{"id":"CVE-2026-19499","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19499","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19499","date":"2026-10-08","epss":0.00297,"percentile":0.20503}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34510","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0017"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19499","description":"Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding.\n\nExploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller.\n\nAt the time of publication, no network-facing application impact is known."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-08","epss":0.00297,"percentile":0.20501}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-08","epss":0.00294,"percentile":0.20148}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-08","epss":0.00294,"percentile":0.20148}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-08","epss":0.00292,"percentile":0.19916}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-08","epss":0.00292,"percentile":0.19916}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-08","epss":0.00292,"percentile":0.19916}],"risk":0.146,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-08","epss":0.00292,"percentile":0.19916}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-08","epss":0.00278,"percentile":0.18565}],"risk":0.13899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-08","epss":0.00278,"percentile":0.18565}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53788","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53788","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-08","epss":0.00272,"percentile":0.17938}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53788"},"relatedVulnerabilities":[{"id":"CVE-2026-53788","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-08","epss":0.00272,"percentile":0.17938}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjq","https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53788","description":"rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44169","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44169","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44169"},"relatedVulnerabilities":[{"id":"CVE-2026-44169","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44169","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44169","date":"2026-10-08","epss":0.00269,"percentile":0.17479}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-22xq-vq3f-87x2","https://jira.mariadb.org/browse/MDEV-39288"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44169","description":"MariaDB server is a community developed fork of MySQL server. From versions 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, a user getting EXECUTE access to a stored routine via a role, could see the routine definition even without SHOW CREATE ROUTINE privilege. This issue has been patched in versions 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89160","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89160","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-08","epss":0.00268,"percentile":0.17337}],"risk":0.134,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89160"},"relatedVulnerabilities":[{"id":"CVE-2026-89160","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89160","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89160","date":"2026-10-08","epss":0.00268,"percentile":0.17337}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-9qww-pwc4-77qq"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89160","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read during the PCRE2_MATCH_INVALID_UTF matching of an invalid UTF subject."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-08","epss":0.00265,"percentile":0.16924}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-08","epss":0.00265,"percentile":0.16924}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89092","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-08","epss":0.00265,"percentile":0.16924}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89092"},"relatedVulnerabilities":[{"id":"CVE-2026-89092","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.2,"impactScore":2.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89092","cwe":"CWE-789","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-89092","date":"2026-10-08","epss":0.00265,"percentile":0.16924}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34624","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0016","http://www.openwall.com/lists/oss-security/2026/09/11/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89092","description":"The nscd service in the GNU C Library 2.3.4 onwards may crash due to a \nstack overflow when a malicious DNS server returns too large a response \nfor a DNS query, resulting in degraded DNS resolution for the system.\n\n\n\nExploitation of this bug needs a system that has nscd enabled and using \nan untrusted DNS server for name resolution, with the compromised DNS \nserver being capable of processing records large enough to result in a \nstack overflow in an nscd thread stack.  During experimentation, bind 9 \nwas unable to handle large records, but that could change in future or \nwith a different name server.  In typical installations, nscd is \nexecuted in an isolated context as its own user without a shell, due to \nwhich any compromise of that service is isolated.\n\n\n\nThere is a remote possibility of nscd cache corruption if an attacker \nmanages to get the stack pointer into a desired point in the heap, \npotentially resulting in other caches in nscd being overwritten with \ncorrupt data through the stack overflow, until the buggy code path \neventually results in a crash.\n\n\n\nFinally, a crash in nscd may result in performance degradation when \nresolving names, but it does not result in a denial of service."}]},{"artifact":{"id":"0ccc4a05333c0d49","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.5.3-5ubuntu5.6?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.6","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"20b0770632dd3caa","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.5.3-5ubuntu5.6?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.6","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postinst"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.postrm"},{"path":"/var/lib/dpkg/info/libpam-modules-bin.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.prerm"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"eeb3f8fcfdfdeda1","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.5.3-5ubuntu5.6?arch=all&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.6","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"dad7001a8bf38e58","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.5.3-5ubuntu5.6:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.5.3-5ubuntu5.6?arch=amd64&distro=ubuntu-24.04&upstream=pam","type":"deb","version":"1.5.3-5ubuntu5.6","language":"","licenses":["BSD-3-clause","BSD-tcp_wrappers","Beerware","GPL","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL-2","LGPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-10041","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pam","version":"1.5.3-5ubuntu5.6"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-10041","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"risk":0.1325,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-10041"},"relatedVulnerabilities":[{"id":"CVE-2024-10041","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2024-10041","cwe":"CWE-922","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2024-10041","date":"2026-10-08","epss":0.00265,"percentile":0.16907}],"urls":["https://access.redhat.com/errata/RHSA-2024:10379","https://access.redhat.com/errata/RHSA-2024:11250","https://access.redhat.com/errata/RHSA-2024:9941","https://access.redhat.com/security/cve/CVE-2024-10041","https://bugzilla.redhat.com/show_bug.cgi?id=2319212","https://github.com/linux-pam/linux-pam/commit/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/commit/b7b96362087414e52524d3d9d9b3faa21e1db620","https://github.com/linux-pam/linux-pam/pull/b3020da7da384d769f27a8713257fbe1001878be","https://github.com/linux-pam/linux-pam/pull/b7b96362087414e52524d3d9d9b3faa21e1db620"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-10041","description":"A vulnerability was found in PAM. The secret information is stored in memory, where the attacker can trigger the victim program to execute by sending characters to its standard input (stdin). As this occurs, the attacker can train the branch predictor to execute an ROP chain speculatively. This flaw could result in leaked passwords, such as those found in /etc/shadow while performing authentications."}]},{"artifact":{"id":"063550efa23293f6","cpes":["cpe:2.3:a:coreutils:coreutils:9.4-3ubuntu6.2:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:deb/ubuntu/coreutils@9.4-3ubuntu6.2?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"9.4-3ubuntu6.2","language":"","licenses":["BSD-4-clause-UC","FSFULLR","GFDL-1.3","GFDL-NIV-1.3","GPL-3","GPL-3+","ISC"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/coreutils/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/coreutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/coreutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/coreutils.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/coreutils.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"coreutils","version":"9.4-3ubuntu6.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"risk":0.1284,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-2781"},"relatedVulnerabilities":[{"id":"CVE-2016-2781","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-10-08","epss":0.00428,"percentile":0.35056}],"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"risk":0.128,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15534"},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"risk":0.128,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15534"},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"risk":0.128,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15534"},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.6"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-15534","versionConstraint":"< 5.38.2-3.2ubuntu0.6 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-15534","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.6"],"available":[{"date":"2026-09-16","kind":"advisory","version":"5.38.2-3.2ubuntu0.6"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"risk":0.128,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15534"},"relatedVulnerabilities":[{"id":"CVE-2026-15534","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15534","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-15534","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15534","date":"2026-10-08","epss":0.00256,"percentile":0.15832}],"urls":["https://github.com/Perl/perl5/commit/54cf3d44cbbedd17d774e9a37921963e8fd5d0cb.patch","https://github.com/Perl/perl5/commit/568e6fd238867bb9e99fa3f47cba3169009239e0.patch","http://www.openwall.com/lists/oss-security/2026/08/09/12","http://www.openwall.com/lists/oss-security/2026/08/09/13"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15534","description":"Perl versions through 5.45.1 have out-of-bounds heap reads and writes during regular expression matching via an undersized superlinear cache in S_regmatch.\n\nThe regex engine's superlinear cache holds one bit per subject position for each participating WHILEM node, so the bit count is the subject length plus one times the number of nodes. Nothing checks that product for positive overflow of the signed 32-bit count: a 286331153 byte subject matched against a pattern with 15 participating nodes stores the count as 14, leaving a two byte cache. The cache is then indexed from the real match position and node number, so reads go past the end of the allocation, and on failure CACHEsayNO sets a bit past it.\n\nA caller that matches an attacker controlled subject of this size against a pattern of this shape can crash the process or corrupt heap memory."}]},{"artifact":{"id":"271cbc4b0386e5d1","cpes":["cpe:2.3:a:login:login:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"login","purl":"pkg:deb/ubuntu/login@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/login/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/login/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/login.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.list"},{"path":"/var/lib/dpkg/info/login.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.postinst"},{"path":"/var/lib/dpkg/info/login.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.postrm"},{"path":"/var/lib/dpkg/info/login.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.preinst"},{"path":"/var/lib/dpkg/info/login.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/login.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-08","epss":0.00426,"percentile":0.34901}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-08","epss":0.00426,"percentile":0.34901}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"12ce9c7a4baa2c69","cpes":["cpe:2.3:a:passwd:passwd:1\\:4.13\\+dfsg1-4ubuntu3.2:*:*:*:*:*:*:*"],"name":"passwd","purl":"pkg:deb/ubuntu/passwd@1%3A4.13%2Bdfsg1-4ubuntu3.2?arch=amd64&distro=ubuntu-24.04&upstream=shadow","type":"deb","version":"1:4.13+dfsg1-4ubuntu3.2","language":"","licenses":["BSD-3-clause","GPL-1","GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/passwd/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/passwd/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/passwd.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.list"},{"path":"/var/lib/dpkg/info/passwd.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.postinst"},{"path":"/var/lib/dpkg/info/passwd.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.postrm"},{"path":"/var/lib/dpkg/info/passwd.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.preinst"},{"path":"/var/lib/dpkg/info/passwd.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/passwd.prerm"}],"upstreams":[{"name":"shadow"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2024-56433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"shadow","version":"1:4.13+dfsg1-4ubuntu3.2"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2024-56433","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-08","epss":0.00426,"percentile":0.34901}],"risk":0.1278,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-56433"},"relatedVulnerabilities":[{"id":"CVE-2024-56433","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":3.6,"impactScore":2.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-56433","cwe":"CWE-1188","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2024-56433","date":"2026-10-08","epss":0.00426,"percentile":0.34901}],"urls":["https://github.com/shadow-maint/shadow/blob/e2512d5741d4a44bdd81a8c2d0029b6222728cf0/etc/login.defs#L238-L241","https://github.com/shadow-maint/shadow/issues/1157","https://github.com/shadow-maint/shadow/releases/tag/4.4"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-56433","description":"shadow-utils (aka shadow) 4.4 through 4.17.0 establishes a default /etc/subuid behavior (e.g., uid 100000 through 165535 for the first user account) that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by leveraging newuidmap for access to an NFS home directory (or same-host resources in the case of remote logins by these local network users). NOTE: it may also be argued that system administrators should not have assigned uids, within local networks, that are within the range that can occur in /etc/subuid."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-08","epss":0.00247,"percentile":0.14674}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89158","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-89158","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-08","epss":0.00247,"percentile":0.14628}],"risk":0.1235,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89158"},"relatedVulnerabilities":[{"id":"CVE-2026-89158","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89158","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89158","date":"2026-10-08","epss":0.00247,"percentile":0.14628}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-fmgr-6ggq-9859"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89158","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_compile_32 integer overflow and resultant out-of-bounds write."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53784","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53784","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53784","date":"2026-10-08","epss":0.00238,"percentile":0.13613}],"risk":0.11900000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53784"},"relatedVulnerabilities":[{"id":"CVE-2026-53784","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53784","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53784","date":"2026-10-08","epss":0.00238,"percentile":0.13613}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-ffg2-fr5g-3rxw","https://www.vulncheck.com/advisories/rsync-path-traversal-via-symlink-module-root"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53784","description":"rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53802","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53802","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53802","cwe":"CWE-61","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53802","date":"2026-10-08","epss":0.00238,"percentile":0.13613}],"risk":0.11900000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53802"},"relatedVulnerabilities":[{"id":"CVE-2026-53802","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53802","cwe":"CWE-61","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53802","date":"2026-10-08","epss":0.00238,"percentile":0.13613}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-4mfr-8jrv-49x4","https://www.vulncheck.com/advisories/rsync-arbitrary-file-read-via-symlink-following"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53802","description":"rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process."}]},{"artifact":{"id":"dadaa29a63de436b","cpes":["cpe:2.3:a:libssl3t64:libssl3t64:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"libssl3t64","purl":"pkg:deb/ubuntu/libssl3t64@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04&upstream=openssl","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3t64/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libssl3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libssl3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.16"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"< 3.0.13-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.16"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.13-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.1161,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"51ccd3eb702e2257","cpes":["cpe:2.3:a:openssl:openssl:3.0.13-0ubuntu3.12:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@3.0.13-0ubuntu3.12?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.0.13-0ubuntu3.12","language":"","licenses":[],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"3.0.13-0ubuntu3.16"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"< 3.0.13-0ubuntu3.16 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"openssl","version":"3.0.13-0ubuntu3.12"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"fixed","versions":["3.0.13-0ubuntu3.16"],"available":[{"date":"2026-09-29","kind":"advisory","version":"3.0.13-0ubuntu3.16"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"risk":0.1161,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-10-08","epss":0.00387,"percentile":0.30642}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53803","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53803","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53803","date":"2026-10-08","epss":0.00229,"percentile":0.12621}],"risk":0.11449999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53803"},"relatedVulnerabilities":[{"id":"CVE-2026-53803","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53803","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53803","date":"2026-10-08","epss":0.00229,"percentile":0.12621}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-g9f4-7q66-9582","https://www.vulncheck.com/advisories/rsync-symlink-following-arbitrary-file-overwrite"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53803","description":"rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-08","epss":0.00226,"percentile":0.1218}],"risk":0.11299999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19542"},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-08","epss":0.00226,"percentile":0.1218}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19542","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-19542","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-08","epss":0.00226,"percentile":0.1218}],"risk":0.11299999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19542"},"relatedVulnerabilities":[{"id":"CVE-2026-19542","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"impactScore":3.4,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19542","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-19542","date":"2026-10-08","epss":0.00226,"percentile":0.1218}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34506","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0018"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19542","description":"Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application.\n\nThe tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree.  Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete.  The written value is a pointer into a tree node and is not directly attacker controlled.  No affected application in common distributions has been identified."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-08","epss":0.02234,"percentile":0.82254}],"risk":0.1117,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-08","epss":0.02234,"percentile":0.82254}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2016-20013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2016-20013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-08","epss":0.02234,"percentile":0.82254}],"risk":0.1117,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2016-20013"},"relatedVulnerabilities":[{"id":"CVE-2016-20013","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-20013","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2016-20013","date":"2026-10-08","epss":0.02234,"percentile":0.82254}],"urls":["https://akkadia.org/drepper/SHA-crypt.txt","https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/","https://twitter.com/solardiz/status/795601240151457793"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-20013","description":"sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password."}]},{"artifact":{"id":"63563c936750dadd","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-08","epss":0.0022,"percentile":0.11377}],"risk":0.11,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6791"},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-08","epss":0.0022,"percentile":0.11377}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"634848afdf334666","cpes":["cpe:2.3:a:libc6:libc6:2.39-0ubuntu8.8:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.39-0ubuntu8.8?arch=amd64&distro=ubuntu-24.04&upstream=glibc","type":"deb","version":"2.39-0ubuntu8.8","language":"","licenses":["sha256:d3c95b56fa33e28b57860580f0baf4e4f4de2a268a2b80f1d031a5191bade265"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"fix":{"suggestedVersion":"2.39-0ubuntu8.9"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6791","versionConstraint":"< 2.39-0ubuntu8.9 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"glibc","version":"2.39-0ubuntu8.8"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-6791","fix":{"state":"fixed","versions":["2.39-0ubuntu8.9"],"available":[{"date":"2026-09-10","kind":"advisory","version":"2.39-0ubuntu8.9"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-08","epss":0.0022,"percentile":0.11377}],"risk":0.11,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6791"},"relatedVulnerabilities":[{"id":"CVE-2026-6791","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:L/SA:H/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6791","cwe":"CWE-121","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6791","date":"2026-10-08","epss":0.0022,"percentile":0.11377}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6791","description":"When expanding paths that begin with a tilde (~) followed by a username, the internal parse_tilde function extracts the username to determine the user's home directory.  The implementation allocates memory for this username directly on the stack using the strndupa macro. Because the size of this allocation was determined by the length of the user-supplied input without any bounds checks, passing an excessively long username e.g. thousands of characters, forces the thread to exhaust its stack space. Thus if an application passes untrusted, attacker-controlled input to the wordexp function, an attacker can trigger a stack clash."}]},{"artifact":{"id":"3c0ad287e54229a6","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.5","type":"deb","version":"1:2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"39ee0553a5289e3b","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"9c3ce62925a3c63c","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"e9ce5bacf834f391","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"12e93d3f2a68625a","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"acbdafc6d61c681f","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"5b3469dc9628ba1a","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-76642","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-76642","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"risk":0.108,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-76642"},"relatedVulnerabilities":[{"id":"CVE-2026-76642","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-76642","cwe":"CWE-390","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-76642","date":"2026-10-08","epss":0.00216,"percentile":0.10995}],"urls":["https://github.com/util-linux/util-linux","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L476","https://github.com/util-linux/util-linux/blob/v2.42.2/libmount/src/context_mount.c#L892","https://github.com/util-linux/util-linux/commit/1d14676ea70003e9f5b2a6a76af0cadb1190411a","https://github.com/util-linux/util-linux/commit/a15c00a9e545aa8b9cf6ec0f888ff6c7b3eaeedc","https://github.com/util-linux/util-linux/commit/f57cea130839c0af8dc0525274267ae4cfd66bbf","https://github.com/util-linux/util-linux/security/advisories/GHSA-m25x-3hj9-m26f","https://www.vulncheck.com/advisories/util-linux-libmount-privilege-escalation-via-failed-mount-helper"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-76642","description":"util-linux versions through 2.41.5 and 2.42.2 fail to check mount helper exit status before running post-mount hooks, allowing unprivileged users to execute privileged operations on pre-existing filesystems. Attackers can exploit X-mount.idmap or X-mount.owner hooks to clone filesystems with inherited suid bits or modify target inode permissions after a helper fails, achieving privilege escalation."}]},{"artifact":{"id":"af95be31c1ad9110","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.42-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.42-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.42-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=pcre2","type":"deb","version":"10.42-4ubuntu2.1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"pcre2","version":"10.42-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-08","epss":0.00214,"percentile":0.10812}],"risk":0.107,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-08","epss":0.00214,"percentile":0.10812}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"ef575a83048d5729","cpes":["cpe:2.3:a:libperl5.38t64:libperl5.38t64:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.38t64","purl":"pkg:deb/ubuntu/libperl5.38t64@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.38t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libperl5.38t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libperl5.38t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57432"},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"8d2efa2469bebea5","cpes":["cpe:2.3:a:perl:perl:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57432"},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"fa96e1f25c487296","cpes":["cpe:2.3:a:perl-base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.38.2-3.2ubuntu0.3?arch=amd64&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57432"},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"20c721d316783591","cpes":["cpe:2.3:a:perl-modules-5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.38:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.38:5.38.2-3.2ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.38","purl":"pkg:deb/ubuntu/perl-modules-5.38@5.38.2-3.2ubuntu0.3?arch=all&distro=ubuntu-24.04&upstream=perl","type":"deb","version":"5.38.2-3.2ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.38/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/perl-modules-5.38/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.38.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/perl-modules-5.38.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"fix":{"suggestedVersion":"5.38.2-3.2ubuntu0.4"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57432","versionConstraint":"< 5.38.2-3.2ubuntu0.4 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"perl","version":"5.38.2-3.2ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-57432","fix":{"state":"fixed","versions":["5.38.2-3.2ubuntu0.4"],"available":[{"date":"2026-08-27","kind":"advisory","version":"5.38.2-3.2ubuntu0.4"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"risk":0.1055,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57432"},"relatedVulnerabilities":[{"id":"CVE-2026-57432","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57432","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-57432","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57432","date":"2026-10-08","epss":0.00211,"percentile":0.10407}],"urls":["https://github.com/Perl/perl5/commit/40754edc72dd3e513d758153c0e2f0215897740e.patch","https://github.com/Perl/perl5/commit/5f7eb6bbbe0510964e3fb1d6bb691e5445913e55.patch","http://www.openwall.com/lists/oss-security/2026/07/13/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57432","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have an integer overflow in S_measure_struct leading to an out-of-bounds heap read in pack and unpack.\n\nS_measure_struct adds each item's size times its repeat count to a running total with no overflow check, so a large repeat count in a pack or unpack template wraps the signed SSize_t total negative. The @, X, and x position codes then guard their moves with a signed length comparison that passes when the length is negative, advancing the buffer pointer out of bounds.\n\nA template derived from untrusted input can read heap memory past the buffer and return it to the caller."}]},{"artifact":{"id":"0ff6c45a645ef14b","cpes":["cpe:2.3:a:libp11-kit0:libp11-kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libp11-kit0:libp11_kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11-kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libp11_kit0:libp11_kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11-kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:libp11:libp11_kit0:0.25.3-4ubuntu2.1:*:*:*:*:*:*:*"],"name":"libp11-kit0","purl":"pkg:deb/ubuntu/libp11-kit0@0.25.3-4ubuntu2.1?arch=amd64&distro=ubuntu-24.04&upstream=p11-kit","type":"deb","version":"0.25.3-4ubuntu2.1","language":"","licenses":["Apache-2.0","BSD-3-clause","FSFAP","FSFULLR","GPL-2+","GPL-3+","ISC","LGPL-2.1","LGPL-2.1+","X11","customFSFUL","customFSFULLRWD"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libp11-kit0/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libp11-kit0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libp11-kit0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"p11-kit"}]},"matchDetails":[{"fix":{"suggestedVersion":"0.25.3-4ubuntu2.2"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13757","versionConstraint":"< 0.25.3-4ubuntu2.2 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"p11-kit","version":"0.25.3-4ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-13757","fix":{"state":"fixed","versions":["0.25.3-4ubuntu2.2"],"available":[{"date":"2026-08-27","kind":"advisory","version":"0.25.3-4ubuntu2.2"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-13757","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13757","date":"2026-10-08","epss":0.00202,"percentile":0.09262}],"risk":0.101,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13757"},"relatedVulnerabilities":[{"id":"CVE-2026-13757","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13757","cwe":"CWE-674","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-13757","date":"2026-10-08","epss":0.00202,"percentile":0.09262}],"urls":["https://access.redhat.com/errata/RHSA-2026:37469","https://access.redhat.com/errata/RHSA-2026:38342","https://access.redhat.com/errata/RHSA-2026:49667","https://access.redhat.com/errata/RHSA-2026:49668","https://access.redhat.com/errata/RHSA-2026:53371","https://access.redhat.com/errata/RHSA-2026:54387","https://access.redhat.com/errata/RHSA-2026:54760","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72394","https://access.redhat.com/errata/RHSA-2026:72395","https://access.redhat.com/errata/RHSA-2026:72399","https://access.redhat.com/errata/RHSA-2026:72470","https://access.redhat.com/errata/RHSA-2026:72475","https://access.redhat.com/errata/RHSA-2026:72476","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/security/cve/CVE-2026-13757","https://bugzilla.redhat.com/show_bug.cgi?id=2494556","https://github.com/advisories/GHSA-p2wm-69qx-x25w"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13757","description":"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60163","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-60163","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"risk":0.0965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60163"},"relatedVulnerabilities":[{"id":"CVE-2026-60163","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60163","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60163","date":"2026-10-08","epss":0.00193,"percentile":0.08161}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html","http://www.openwall.com/lists/oss-security/2026/09/15/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60163","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with logon to the infrastructure where MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.4 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-53785","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53785","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53785","date":"2026-10-08","epss":0.00192,"percentile":0.08136}],"risk":0.096,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53785"},"relatedVulnerabilities":[{"id":"CVE-2026-53785","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53785","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53785","date":"2026-10-08","epss":0.00192,"percentile":0.08136}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pph3-7xmf-rrqg","https://www.vulncheck.com/advisories/rsync-path-traversal-write-escape-via-relative-mode"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53785","description":"rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4869","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4869","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-08","epss":0.00182,"percentile":0.07143}],"risk":0.09555000000000001,"urls":["https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763766","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."},"relatedVulnerabilities":[{"id":"CVE-2026-32288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-08","epss":0.00182,"percentile":0.07143}],"urls":["https://go.dev/cl/763766","https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4869"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32288","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."}]},{"artifact":{"id":"a8cfaaa603018cb2","cpes":["cpe:2.3:a:libsqlite3-0:libsqlite3-0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3-0:libsqlite3_0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3-0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3_0:libsqlite3_0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3-0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*","cpe:2.3:a:libsqlite3:libsqlite3_0:3.45.1-1ubuntu2.7:*:*:*:*:*:*:*"],"name":"libsqlite3-0","purl":"pkg:deb/ubuntu/libsqlite3-0@3.45.1-1ubuntu2.7?arch=amd64&distro=ubuntu-24.04&upstream=sqlite3","type":"deb","version":"3.45.1-1ubuntu2.7","language":"","licenses":["GPL-2","GPL-2+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsqlite3-0/copyright","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/share/doc/libsqlite3-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/libsqlite3-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"sqlite3"}]},"matchDetails":[{"fix":{"suggestedVersion":"3.45.1-1ubuntu2.8"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-39113","versionConstraint":"< 3.45.1-1ubuntu2.8 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"sqlite3","version":"3.45.1-1ubuntu2.7"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-39113","fix":{"state":"fixed","versions":["3.45.1-1ubuntu2.8"],"available":[{"date":"2026-09-16","kind":"advisory","version":"3.45.1-1ubuntu2.8"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-39113","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39113","date":"2026-10-08","epss":0.00191,"percentile":0.08055}],"risk":0.0955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-39113"},"relatedVulnerabilities":[{"id":"CVE-2026-39113","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":4,"impactScore":1.5,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39113","cwe":"CWE-122","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39113","date":"2026-10-08","epss":0.00191,"percentile":0.08055}],"urls":["https://github.com/20000419/CVE-2026-39113","https://github.com/sqlite/sqlite/blob/169f68ed88b34cb68f720191c64c058f2ccec508/ext/misc/sqlar.c","https://github.com/sqlite/sqlite/commit/169f68ed88b34cb68f720191c64c058f2ccec508","https://www.sqlite.org/","https://www.sqlite.org/sqlar.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39113","description":"Buffer Overflow vulnerability in SQLite affected version source snapshots/builds containing Fossil check-in 8bdc0d485e3ad0c7a1e818da66f106951d496b05cbe61d12c2c448f2f24b6d5d (Git mirror 169f68ed88b34cb68f720191c64c058f2ccec508, 2026-03-11) and later snapshots/builds allows an attacker to cause a denial of service via the ext/misc/sqlar.c, sqlarUncompressFunc(), sqlar_uncompress(), sqlite3_value_int64(), sqlite3_malloc(int), uncompress() components"}]},{"artifact":{"id":"7cc9401a1034b767","cpes":["cpe:2.3:a:rsync:rsync:3.2.7-1ubuntu1.5:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.2.7-1ubuntu1.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"3.2.7-1ubuntu1.5","language":"","licenses":["sha256:240afc05aff098e53dafe0def34030b2ef7848b78b9ebabf2c157713b9f975c5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70454","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"rsync","version":"3.2.7-1ubuntu1.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-70454","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70454","cwe":"CWE-295","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70454","date":"2026-10-08","epss":0.0019,"percentile":0.07879}],"risk":0.095,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70454"},"relatedVulnerabilities":[{"id":"CVE-2026-70454","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":8,"impactScore":5.8,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70454","cwe":"CWE-295","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70454","date":"2026-10-08","epss":0.0019,"percentile":0.07879}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-3c3x-ww2w-5r5p","https://www.vulncheck.com/advisories/rsync-tls-certificate-validation-bypass-via-ssl-openssl-mode"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70454","description":"rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client."}]},{"artifact":{"id":"3c0ad287e54229a6","cpes":["cpe:2.3:a:bsdutils:bsdutils:1\\:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"bsdutils","purl":"pkg:deb/ubuntu/bsdutils@1%3A2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux%402.39.3-9ubuntu6.5","type":"deb","version":"1:2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/bsdutils/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/bsdutils/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/bsdutils.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/bsdutils.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/bsdutils.list"}],"upstreams":[{"name":"util-linux","version":"2.39.3-9ubuntu6.5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"39ee0553a5289e3b","cpes":["cpe:2.3:a:libblkid1:libblkid1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libblkid1","purl":"pkg:deb/ubuntu/libblkid1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libblkid1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libblkid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libblkid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"9c3ce62925a3c63c","cpes":["cpe:2.3:a:libmount1:libmount1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libmount1","purl":"pkg:deb/ubuntu/libmount1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmount1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libmount1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmount1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libmount1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"e9ce5bacf834f391","cpes":["cpe:2.3:a:libsmartcols1:libsmartcols1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libsmartcols1","purl":"pkg:deb/ubuntu/libsmartcols1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsmartcols1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libsmartcols1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libsmartcols1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"12e93d3f2a68625a","cpes":["cpe:2.3:a:libuuid1:libuuid1:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"libuuid1","purl":"pkg:deb/ubuntu/libuuid1@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libuuid1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libuuid1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libuuid1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"acbdafc6d61c681f","cpes":["cpe:2.3:a:mount:mount:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"mount","purl":"pkg:deb/ubuntu/mount@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04&upstream=util-linux","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mount/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/mount/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/mount.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mount.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/mount.list"}],"upstreams":[{"name":"util-linux"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"5b3469dc9628ba1a","cpes":["cpe:2.3:a:util-linux:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util-linux:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util_linux:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util:util-linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*","cpe:2.3:a:util:util_linux:2.39.3-9ubuntu6.5:*:*:*:*:*:*:*"],"name":"util-linux","purl":"pkg:deb/ubuntu/util-linux@2.39.3-9ubuntu6.5?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"2.39.3-9ubuntu6.5","language":"","licenses":["BSD-3-clause","BSD-4-clause","BSLA","GPL-2","GPL-2+","GPL-3","GPL-3+","LGPL","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","MIT","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/util-linux/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/util-linux/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/util-linux.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.list"},{"path":"/var/lib/dpkg/info/util-linux.postinst","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.postinst"},{"path":"/var/lib/dpkg/info/util-linux.postrm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.postrm"},{"path":"/var/lib/dpkg/info/util-linux.prerm","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/util-linux.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-78408","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"util-linux","version":"2.39.3-9ubuntu6.5"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-78408","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"risk":0.093,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-78408"},"relatedVulnerabilities":[{"id":"CVE-2026-78408","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.9,"impactScore":5.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78408","cwe":"CWE-775","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-78408","date":"2026-10-08","epss":0.00186,"percentile":0.07549}],"urls":["https://access.redhat.com/errata/RHSA-2026:63162","https://access.redhat.com/security/cve/CVE-2026-78408","https://bugzilla.redhat.com/show_bug.cgi?id=2522497","https://github.com/util-linux/util-linux/security/advisories/GHSA-55fx-f4gg-cfhj","http://www.openwall.com/lists/oss-security/2026/09/05/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78408","description":"The nsenter --join-cgroup option opens the target cgroup.procs file as root and leaves that file descriptor open across later namespace and credential changes and across execve(). Because the kernel checks later cgroup migrations using the credentials from the original open, a program run in an attacker-controlled target can inherit root's ability to move host processes between cgroups. After a privileged operator uses --join-cgroup against that target, an unprivileged user can migrate and terminate unrelated root processes."}]},{"artifact":{"id":"84189c52cc07ec75","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.190-1.1ubuntu0.1:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.190-1.1ubuntu0.1?arch=amd64&distro=ubuntu-24.04&upstream=elfutils","type":"deb","version":"0.190-1.1ubuntu0.1","language":"","licenses":["BSD-2-clause","GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"elfutils","version":"0.190-1.1ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2025-1376","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-08","epss":0.00309,"percentile":0.2173}],"risk":0.09269999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1376"},"relatedVulnerabilities":[{"id":"CVE-2025-1376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:L/AC:H/Au:S/C:N/I:N/A:P","metrics":{"baseScore":1,"impactScore":2.9,"exploitabilityScore":1.6},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1376","cwe":"CWE-404","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1376","date":"2026-10-08","epss":0.00309,"percentile":0.2173}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15940","https://sourceware.org/bugzilla/show_bug.cgi?id=32672","https://sourceware.org/bugzilla/show_bug.cgi?id=32672#c3","https://vuldb.com/?ctiid.295984","https://vuldb.com/?id.295984","https://vuldb.com/?submit.497538","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1376","description":"A vulnerability classified as problematic was found in GNU elfutils 0.192. This vulnerability affects the function elf_strptr in the library /libelf/elf_strptr.c of the component eu-strip. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is b16f441cca0a4841050e3215a9f120a6d8aea918. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"e22d4a91605b2d72","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.643-4ubuntu0.1:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.643-4ubuntu0.1?arch=amd64&distro=ubuntu-24.04","type":"deb","version":"1.643-4ubuntu0.1","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-88815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"libdbi-perl","version":"1.643-4ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-88815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-88815","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-88815","date":"2026-10-08","epss":0.00183,"percentile":0.07246}],"risk":0.0915,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-88815"},"relatedVulnerabilities":[{"id":"CVE-2026-88815","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.2,"impactScore":3.6,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-88815","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-88815","date":"2026-10-08","epss":0.00183,"percentile":0.07246}],"urls":["https://github.com/perl5-dbi/dbi/commit/e5ad87e5602da995d28b4d65df222368b58d6702.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-c8vq-w3wr-6979","https://metacpan.org/release/HMBRAND/DBI-1.654/changes","http://www.openwall.com/lists/oss-security/2026/09/28/12"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-88815","description":"DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sql_type_cast_svpv.\n\nWhen casting to SQL_NUMERIC, sql_type_cast_svpv passes the string pointer and length of the SV to grok_number without stringifying it first. An integer (IV) or floating-point (NV) value has no valid string pointer, so grok_number reads from an invalid address, triggering a segmentation fault.\n\nThis is reachable in Perl using the sql_type_cast function:\n\n  my $num = 42;\n  DBI::sql_type_cast( $num, DBI::SQL_NUMERIC, 0 );"}]},{"artifact":{"id":"f220b53ee9e82286","cpes":["cpe:2.3:a:libattr1:libattr1:1\\:2.5.2-1build1.1:*:*:*:*:*:*:*"],"name":"libattr1","purl":"pkg:deb/ubuntu/libattr1@1%3A2.5.2-1build1.1?arch=amd64&distro=ubuntu-24.04&upstream=attr","type":"deb","version":"1:2.5.2-1build1.1","language":"","licenses":["GPL-2","GPL-2+","LGPL-2+","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libattr1/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/libattr1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libattr1:amd64.conffiles","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libattr1:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libattr1:amd64.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/libattr1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"attr"}]},"matchDetails":[{"fix":{"suggestedVersion":"1:2.5.2-1ubuntu0.1"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54371","versionConstraint":"< 1:2.5.2-1ubuntu0.1 (deb)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"attr","version":"1:2.5.2-1build1.1"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-54371","fix":{"state":"fixed","versions":["1:2.5.2-1ubuntu0.1"],"available":[{"date":"2026-08-31","kind":"advisory","version":"1:2.5.2-1ubuntu0.1"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54371","date":"2026-10-08","epss":0.00179,"percentile":0.06854}],"risk":0.0895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54371"},"relatedVulnerabilities":[{"id":"CVE-2026-54371","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":6.3,"impactScore":5.2,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.4},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":5.2,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-54371","cwe":"CWE-59","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-54371","date":"2026-10-08","epss":0.00179,"percentile":0.06854}],"urls":["https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=49f79e947270f06940b9100fa638f85dddc4aa7f","https://cgit.git.savannah.nongnu.org/cgit/attr.git/commit/?id=c440855d6b33446edf4b5eb1a2d892281f15a99b","https://www.vulncheck.com/advisories/attr-symlink-traversal-privilege-escalation-via-getfattr-setfattr","https://access.redhat.com/errata/RHSA-2026:34889","https://access.redhat.com/errata/RHSA-2026:56133","https://access.redhat.com/errata/RHSA-2026:59380","https://access.redhat.com/errata/RHSA-2026:60226","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:63135","https://access.redhat.com/errata/RHSA-2026:63138","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/security/cve/CVE-2026-54371","https://bugzilla.redhat.com/show_bug.cgi?id=2490283","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-54371.json"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54371","description":"attr before version 2.6.0 contains a symlink traversal vulnerability in the getfattr and setfattr utilities that allows local attackers to escalate privileges by replacing a pathname component with a symbolic link during directory hierarchy traversal. Attackers who control a pathname component can redirect getfattr and setfattr operations to arbitrary files by substituting a symlink, leading to local privilege escalation when getfattr or setfattr is invoked by a privileged process over an attacker-controlled path."}]},{"artifact":{"id":"4306213600e94132","cpes":["cpe:2.3:a:gpg:gpg:2.4.4-2ubuntu17.4:*:*:*:*:*:*:*"],"name":"gpg","purl":"pkg:deb/ubuntu/gpg@2.4.4-2ubuntu17.4?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.4","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpg/copyright","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/share/doc/gpg/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/gpg.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpg.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/gpg.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"01dc27f70abb0078","cpes":["cpe:2.3:a:gpgconf:gpgconf:2.4.4-2ubuntu17.4:*:*:*:*:*:*:*"],"name":"gpgconf","purl":"pkg:deb/ubuntu/gpgconf@2.4.4-2ubuntu17.4?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.4","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgconf/copyright","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/usr/share/doc/gpgconf/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.md5sums","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/gpgconf.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgconf.list","layerID":"sha256:9600650333e042952fd23f5c0cf18f28ecdf4c618bed015ad2f8d90b8d874e08","accessPath":"/var/lib/dpkg/info/gpgconf.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"c523498c8ece7464","cpes":["cpe:2.3:a:gpgv:gpgv:2.4.4-2ubuntu17.4:*:*:*:*:*:*:*"],"name":"gpgv","purl":"pkg:deb/ubuntu/gpgv@2.4.4-2ubuntu17.4?arch=amd64&distro=ubuntu-24.04&upstream=gnupg2","type":"deb","version":"2.4.4-2ubuntu17.4","language":"","licenses":["BSD-3-clause","CC0-1.0","Expat","GPL-2+","GPL-2.0","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+","RFC-Reference","TinySCHEME","permissive"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gpgv/copyright","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/usr/share/doc/gpgv/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.md5sums","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/gpgv.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gpgv.list","layerID":"sha256:b9a65b3c65ab22d490085bd0bf5490e2409da8748b406870f2463bdc41cd6795","accessPath":"/var/lib/dpkg/info/gpgv.list"}],"upstreams":[{"name":"gnupg2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-3219","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"gnupg2","version":"2.4.4-2ubuntu17.4"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2022-3219","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"risk":0.08789999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-3219"},"relatedVulnerabilities":[{"id":"CVE-2022-3219","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2022-3219","cwe":"CWE-787","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2022-3219","date":"2026-10-08","epss":0.00293,"percentile":0.20038}],"urls":["https://access.redhat.com/security/cve/CVE-2022-3219","https://bugzilla.redhat.com/show_bug.cgi?id=2127010","https://dev.gnupg.org/D556","https://dev.gnupg.org/T5993","https://marc.info/?l=oss-security&m=165696590211434&w=4","https://security.netapp.com/advisory/ntap-20230324-0001/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-3219","description":"GnuPG can be made to spin on a relatively small input by (for example) crafting a public key with thousands of signatures attached, compressed down to just a few KB."}]},{"artifact":{"id":"815141309c65ed6b","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e88c07c83e042a37","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"364dfa03376335df","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"201458a6c51e8250","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"3ed4a228d0a20696","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"7f70d66d6f4e3345","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"e842aea9c25c18f8","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A11.4.12%2Bmaria~ubu2404?arch=amd64&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]},{"artifact":{"id":"4498e79473c13670","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:11.4.12\\+maria\\~ubu2404:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A11.4.12%2Bmaria~ubu2404?arch=all&distro=ubuntu-24.04&upstream=mariadb","type":"deb","version":"1:11.4.12+maria~ubu2404","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:018824f8776d8f882e3ccfd8db33d4634d4399b4fd9db73912e16f70dbe5fe04","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-44171","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"24.04"},"package":{"name":"mariadb","version":"1:11.4.12+maria~ubu2404"},"namespace":"ubuntu:distro:ubuntu:24.04"}}],"vulnerability":{"id":"CVE-2026-44171","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"risk":0.0865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:24.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-44171"},"relatedVulnerabilities":[{"id":"CVE-2026-44171","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.3,"impactScore":5.9,"exploitabilityScore":0.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-44171","cwe":"CWE-22","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-44171","date":"2026-10-08","epss":0.00173,"percentile":0.0619}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-9pjh-5hhw-65v9","https://jira.mariadb.org/browse/MDEV-39408"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-44171","description":"MariaDB server is a community developed fork of MySQL server. From versions 10.6.1 to before 10.6.26, 10.11.1 to before 10.11.17, 11.4.1 to before 11.4.11, 11.8.1 to before 11.8.7, and 12.3.1, mbstream did not check for /../ in the path when unpacking the archive. A proper backup can never contain such paths, but a specially crafted archive could have caused mbstream to create files outside of the target-dir path. This issue has been patched in versions 10.6.26, 10.11.17, 11.4.11, 11.8.7, and 12.3.2."}]}],"grade":"F","score":"0.00","as_of":"2026-10-09T13:42:14.986Z","grype_db_version":"2026-10-09T06:32:32.000Z"}