{"grype_matches":[{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119586","versionConstraint":"<= 3.54.1 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119586","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119586","cwe":"CWE-77","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119586","date":"2026-11-12","epss":0.01545,"percentile":0.75347}],"risk":1.2089625,"urls":["https://abraxaslabs.tech/research/sqlite-cli-recover","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.54.1/ext/recover/sqlite3recover.c#L1221-L1223","https://github.com/sqlite/sqlite/blob/version-3.54.1/src/shell.c.in#L7877-L7891","https://www.vulncheck.com/advisories/sqlite-cli-through-3.54.1-command-injection-via-recover-output"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119586","description":"SQLite command-line shell through 3.54.1 contains a command injection vulnerability in the .recover command that emits attacker-planted dot-commands stored in sqlite_schema.sql values verbatim. Attackers can craft a database whose schema holds a valid CREATE statement followed by a .shell or .system line, executing OS commands when victims pipe .recover output into sqlite3."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-105437","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-105437","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"risk":0.29924999999999996,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-105437"},"relatedVulnerabilities":[{"id":"CVE-2026-105437","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-105437","cwe":"CWE-122","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-105437","date":"2026-11-12","epss":0.00399,"percentile":0.34691}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/814","https://gitlab.com/gitlab-org/gitlab/-/work_items/632121","https://hackerone.com/reports/4044249"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-105437","description":"Affected versions of Git have a heap buffer overflow in the three-way merge\ncode (xdiff), which an attacker can trigger through a repository they\ncontrol.\n\nWhen Git merges a file, it first adds up the size of the merged\noutput, allocates a buffer of that size, and then writes the output into\nit. That total was kept in a 32-bit signed integer. The\nconflict-marker-size attribute, which can be set from a committed\n.gitattributes file, accepts any positive integer, and the markers are\nwritten several times for every conflict. A small file with a huge marker\nsize and many separate conflicts can therefore push the total past 4 GiB,\nso the integer wraps to a small value and Git writes attacker-controlled\nmerge output past the end of a buffer that is too small. At minimum this\ncrashes Git, and because the overflow is large and its contents are largely\nattacker-controlled, worse heap corruption is possible.\n\nAny command that does a textual three-way merge can trigger it, such\nas git-merge(1), git-rebase(1), git-cherry-pick(1), and\ngit-merge-tree(1). The latter is most likely a target for Git forges,\nwhich might use git-merge-tree(1) on the server-side to check\nmergeability. When the server reads attributes from trees in the\nrepository (for example through attr.tree or --attr-source), any\nuser who can push branches and request that they be merged (for\nexample by opening a pull or merge request) can trigger the overflow\nwithout anyone else doing anything, and the data they push is small\nbecause the oversized output only appears during the merge.\n\nThe problem has been patched by computing the size as size_t and\nchecking every addition for overflow, so Git stops with an error\ninstead of overflowing.\n\nServers that cannot upgrade right away can add\n\n* conflict-marker-size=7\n\nto each repository's info/attributes as a workaround, which overrides\nany in-tree .gitattributes, or turn off server-side mergeability checks for\nuntrusted repositories."}]},{"artifact":{"id":"193eb40fb65beba6","cpes":["cpe:2.3:a:zlib:zlib:1.3.2-r1:*:*:*:*:*:*:*"],"name":"zlib","purl":"pkg:apk/alpine/zlib@1.3.2-r1?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.3.2-r1","language":"","licenses":["Zlib"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libz.so.1"},{"path":"/usr/lib/libz.so.1.3.2"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"zlib"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"1.4-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4738","versionConstraint":"< 1.4-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"zlib","version":"1.3.2-r1"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-4738","fix":{"state":"fixed","versions":["1.4-r0"],"available":[{"date":"2026-11-07","kind":"first-observed","version":"1.4-r0"}]},"cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"risk":0.24748,"urls":[],"severity":"Critical","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-4738"},"relatedVulnerabilities":[{"id":"CVE-2026-4738","cvss":[{"type":"Secondary","source":"cve_disclosure@tech.gov.sg","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:U/V:C/RE:L/U:Amber","metrics":{"baseScore":9.4},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4738","cwe":"CWE-119","type":"Secondary","source":"cve_disclosure@tech.gov.sg"}],"epss":[{"cve":"CVE-2026-4738","date":"2026-11-12","epss":0.00269,"percentile":0.19241}],"urls":["https://github.com/OSGeo/gdal/pull/12244"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4738","description":"Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎.\n\nThis issue affects gdal: before 3.11.0."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119379","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119379","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119379","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119379","date":"2026-11-12","epss":0.00278,"percentile":0.20526}],"risk":0.217535,"urls":["https://abraxaslabs.tech/research/sqlite-session-ncol","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/session/sqlite3session.c#L5619","https://github.com/sqlite/sqlite/commit/64459c87cc702d600704fb77ee40ca1782398a52","https://sqlite.org/bugs/info/2026-08-16T10:15:25Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/3f57024aecea0f3b","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-session-extension-sessionupdatefind"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119379","description":"SQLite before 3.54.0 built with the session extension contains a heap buffer overflow vulnerability in sqlite3changeset_apply() that allows attackers to corrupt heap memory by supplying crafted changesets. Attackers can repeat a table name in a second changeset block with a larger column count, causing sessionUpdateFind() to memset past the undersized aUpdateMask allocation."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2016-2781","versionConstraint":"none (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2016-2781","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","metrics":{"baseScore":6.5,"impactScore":4,"exploitabilityScore":2.1},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:L/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":2.1,"impactScore":2.9,"exploitabilityScore":4},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":4.6,"impactScore":2.8,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2016-2781","cwe":"CWE-20","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2016-2781","date":"2026-11-12","epss":0.00428,"percentile":0.37532}],"risk":0.20115999999999998,"urls":["http://www.openwall.com/lists/oss-security/2016/02/28/2","http://www.openwall.com/lists/oss-security/2016/02/28/3","https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-2781","description":"chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-119618","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-119618","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-12","epss":0.00398,"percentile":0.34546}],"risk":0.199,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-119618"},"relatedVulnerabilities":[{"id":"CVE-2026-119618","cvss":[],"cwes":[{"cve":"CVE-2026-119618","cwe":"CWE-362","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-119618","date":"2026-11-12","epss":0.00398,"percentile":0.34546}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/13","https://access.redhat.com/security/cve/cve-2026-119618","https://bugs.gentoo.org/986161","https://github.com/AlmaLinux/updates/issues/4252","https://github.com/microsoft/azurelinux/pull/20165","https://ubuntu.com/security/CVE-2026-119618","https://www.wiz.io/blog/cve-2026-119618-rce-apache-http-server-vulnerability"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119618","description":"Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE.\n\nThis issue affects Apache HTTP Server: from 2.4.55 through 2.4.70.\nAffected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119374","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119374","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119374","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119374","date":"2026-11-12","epss":0.0023,"percentile":0.13979}],"risk":0.179975,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-securedel","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L5525","https://github.com/sqlite/sqlite/commit/d9de6eedbe918c074c7556400fa21df5960704d9","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/9cd4f9e920","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-heap-buffer-overflow-via-fts5-fts5dosecuredelete"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119374","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5DoSecureDelete() that allows attackers to write past the leaf page buffer via crafted footer key offsets. Attackers can supply a database file with a corrupted FTS5 index that, when deleted from with secure-delete enabled, corrupts heap memory and crashes the application."},"relatedVulnerabilities":[]},{"artifact":{"id":"fef07e9c95ea2bda","cpes":["cpe:2.3:a:busybox:busybox:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox","purl":"pkg:apk/alpine/busybox@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/busybox"},{"path":"/etc"},{"path":"/etc/securetty"},{"path":"/etc/busybox-paths.d"},{"path":"/etc/busybox-paths.d/busybox"},{"path":"/etc/logrotate.d"},{"path":"/etc/logrotate.d/acpid"},{"path":"/etc/network"},{"path":"/etc/network/if-down.d"},{"path":"/etc/network/if-post-down.d"},{"path":"/etc/network/if-post-up.d"},{"path":"/etc/network/if-pre-down.d"},{"path":"/etc/network/if-pre-up.d"},{"path":"/etc/network/if-up.d"},{"path":"/etc/network/if-up.d/dad"},{"path":"/etc/udhcpc"},{"path":"/etc/udhcpc/udhcpc.conf"},{"path":"/sbin"},{"path":"/usr"},{"path":"/usr/sbin"},{"path":"/usr/share"},{"path":"/usr/share/udhcpc"},{"path":"/usr/share/udhcpc/default.script"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"915155597fcdee9a","cpes":["cpe:2.3:a:busybox-binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox-binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox_binsh:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox-binsh:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:busybox:busybox_binsh:1.37.0-r31:*:*:*:*:*:*:*"],"name":"busybox-binsh","purl":"pkg:apk/alpine/busybox-binsh@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/sh"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"8a9ef44e1018f213","cpes":["cpe:2.3:a:ssl-client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl-client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl_client:ssl_client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl-client:1.37.0-r31:*:*:*:*:*:*:*","cpe:2.3:a:ssl:ssl_client:1.37.0-r31:*:*:*:*:*:*:*"],"name":"ssl_client","purl":"pkg:apk/alpine/ssl_client@1.37.0-r31?arch=x86_64&distro=alpine-3.24.3&upstream=busybox","type":"apk","version":"1.37.0-r31","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ssl_client"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"busybox"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:busybox:busybox:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2025-60876","versionConstraint":"<= 1.37.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:busybox:busybox:1.37.0:*:*:*:*:*:*:*"],"package":{"name":"busybox","version":"1.37.0-r31"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2025-60876","fix":{"state":"","versions":[]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-60876","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-60876","date":"2026-11-12","epss":0.00312,"percentile":0.24431}],"risk":0.17939999999999998,"urls":["https://gist.github.com/subyumatest/41554af6a72aedaacaec026adc311092","https://lists.busybox.net/pipermail/busybox/attachments/20250823/ccdc96ef/attachment-0001.htm","https://lists.busybox.net/pipermail/busybox/attachments/20250828/e7f90492/attachment.htm","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-60876","description":"BusyBox wget thru 1.3.7 accepted raw CR (0x0D)/LF (0x0A) and other C0 control bytes in the HTTP request-target (path/query), allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw space (0x20) in the request-target must also be rejected (clients should use %20)."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-106023","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-106023","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-12","epss":0.00296,"percentile":0.2256}],"risk":0.148,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-106023"},"relatedVulnerabilities":[{"id":"CVE-2026-106023","cvss":[],"cwes":[{"cve":"CVE-2026-106023","cwe":"CWE-476","type":"Secondary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-106023","date":"2026-11-12","epss":0.00296,"percentile":0.2256}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html","http://www.openwall.com/lists/oss-security/2026/11/11/11"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-106023","description":"NULL pointer dereference vulnerability in Apache HTTP Server's mod_md during HTTP request processing.\n\n\n\nThis issue affects Apache HTTP Server: from 2.4.30 through 2.4.69."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119378","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119378","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119378","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119378","date":"2026-11-12","epss":0.00251,"percentile":0.16587}],"risk":0.13993250000000002,"urls":["https://abraxaslabs.tech/research/sqlite-rtree-rowid0","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/rtree/rtree.c#L905","https://github.com/sqlite/sqlite/commit/d21bd37c7cfc1b85b17a6703555f0926b6236e04","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/6a9e1415659f9e75","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-r-tree-nodewrite"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119378","description":"SQLite before 3.54.0 contains a use-after-free vulnerability in the R-Tree extension that allows attackers to make applications use freed heap memory by manipulating the %_node shadow table. Attackers can supply a database declaring %_node WITHOUT ROWID or with a RAISE(IGNORE) trigger so nodeWrite() hashes nodes as 0, crashing the process after node splits."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119373","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119373","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.5},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119373","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119373","date":"2026-11-12","epss":0.00162,"percentile":0.05485}],"risk":0.126765,"urls":["https://abraxaslabs.tech/research/sqlite-fts5-rowidmerge","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts5/fts5_index.c#L6107","https://github.com/sqlite/sqlite/commit/e1c9934f9f11a499029abb020ea715a08970da80","https://sqlite.org/bugs/info/2026-08-04T08:49:27Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/a7f8c92f62","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-fts5-heap-buffer-overflow-via-fts5mergerowidlists"],"severity":"High","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119373","description":"SQLite before 3.54.0 built with FTS5 contains a heap buffer overflow in fts5MergeRowidLists() that undersizes the output buffer when merging detail=none prefix doclists. Attackers who can populate a detail=none FTS5 table with negative rowids and run a prefix MATCH query can write past the allocation, corrupting heap memory and crashing the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"0a1b804a1f2ce7d7","cpes":["cpe:2.3:a:apache:apache2-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache2_utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache-utils:2.4.69-r0:*:*:*:*:*:*:*","cpe:2.3:a:apache:apache_utils:2.4.69-r0:*:*:*:*:*:*:*"],"name":"apache2-utils","purl":"pkg:apk/alpine/apache2-utils@2.4.69-r0?arch=x86_64&distro=alpine-3.24.3&upstream=apache2","type":"apk","version":"2.4.69-r0","language":"","licenses":["Apache-2.0"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/ab"},{"path":"/usr/bin/dbmmanage"},{"path":"/usr/bin/htdbm"},{"path":"/usr/bin/htdigest"},{"path":"/usr/bin/htpasswd"},{"path":"/usr/bin/httxt2dbm"},{"path":"/usr/bin/logresolve"},{"path":"/usr/sbin"},{"path":"/usr/sbin/checkgid"},{"path":"/usr/sbin/envvars"},{"path":"/usr/sbin/envvars-std"},{"path":"/usr/sbin/htcacheclean"},{"path":"/usr/sbin/rotatelogs"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"apache2"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.4.71-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109163","versionConstraint":"< 2.4.71-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"apache2","version":"2.4.69-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-109163","fix":{"state":"fixed","versions":["2.4.71-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"2.4.71-r0"}]},"cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-12","epss":0.00247,"percentile":0.16175}],"risk":0.1235,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-109163"},"relatedVulnerabilities":[{"id":"CVE-2026-109163","cvss":[],"cwes":[{"cve":"CVE-2026-109163","cwe":"CWE-121","type":"Primary","source":"security@apache.org"}],"epss":[{"cve":"CVE-2026-109163","date":"2026-11-12","epss":0.00247,"percentile":0.16175}],"urls":["https://httpd.apache.org/security/vulnerabilities_24.html"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109163","description":"Stack-based buffer overflow vulnerability in Apache HTTP Server's mod_vhost_alias (after CVE-2026-63292)\n\n\n\nThis issue affects Apache HTTP Server: 2.4.69."}]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119375","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119375","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119375","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119375","date":"2026-11-12","epss":0.00195,"percentile":0.09266}],"risk":0.1087125,"urls":["https://abraxaslabs.tech/research/sqlite-wal-pagesize","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/wal.c#L3672","https://github.com/sqlite/sqlite/commit/e5bf119821f25be1d7f10ef0a2edbe175289166e","https://sqlite.org/bugs/info/2026-08-17T15:54:41Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f9b4ee369557c36c","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-information-disclosure-via-wal-page-size-mismatch"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119375","description":"SQLite before 3.54.0 contains an information disclosure vulnerability that allows attackers to read uninitialized page-cache memory by supplying a WAL file with an undersized page size. Attackers can craft a database and WAL file whose oversized record payload makes queries like substr() return stale bytes, disclosing other table rows and internal pointers."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119371","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119371","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119371","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119371","date":"2026-11-12","epss":0.00191,"percentile":0.08871}],"risk":0.1064825,"urls":["https://abraxaslabs.tech/research/sqlite-cte-nest","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L5754","https://github.com/sqlite/sqlite/commit/e6ff280c839fdfc7418fd5add12e8f32702a17fb","https://sqlite.org/bugs/info/2026-10-04T04:58:58Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/f54730871303e655","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-cte-chain-in-selectexpander"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119371","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH nesting limit because common table expressions are not counted against it. Attackers can supply a WITH clause chaining tens of thousands of CTEs, via plain SQL or a view in an untrusted database file, causing unbounded selectExpander() recursion that crashes the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119376","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119376","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119376","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119376","date":"2026-11-12","epss":0.00183,"percentile":0.07943}],"risk":0.1020225,"urls":["https://abraxaslabs.tech/research/sqlite-collate-depth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/expr.c#L175","https://github.com/sqlite/sqlite/commit/d54522a5b832422ab893a1e9fa7a99ab314ea4e2","https://sqlite.org/bugs/info/2026-10-04T04:50:56Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/252c0b7bf5a727d2","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-collate-operator-chain"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119376","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability that allows attackers to bypass the SQLITE_LIMIT_EXPR_DEPTH limit by chaining COLLATE postfix operators. Attackers can supply roughly 175,000 chained COLLATE operators in SQL or an untrusted database view to trigger unbounded recursion in sqlite3WalkExprNN() and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119591","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119591","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119591","cwe":"CWE-674","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119591","date":"2026-11-12","epss":0.00171,"percentile":0.06577}],"risk":0.0953325,"urls":["https://abraxaslabs.tech/research/sqlite-values-union","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/select.c#L7199","https://github.com/sqlite/sqlite/commit/eff50a067c55f972909e7780e506e91382d08de2","https://sqlite.org/bugs/info/2026-10-04T05:34:47Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/ab621a3e11ee4acc","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-stack-exhaustion-via-countofviewoptimization-in-values-clause"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119591","description":"SQLite before 3.54.0 contains a stack exhaustion vulnerability in countOfViewOptimization() that allows attackers to crash the host process via count(*) over a large multi-row VALUES clause. Attackers supplying SQL or a database file with a crafted view can trigger deeply nested TK_PLUS expressions whose recursive freeing in sqlite3ExprDeleteNN() exhausts the C stack, causing denial of service."},"relatedVulnerabilities":[]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56392","versionConstraint":"= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56392","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":1.8},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56392","cwe":"CWE-122","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56392","date":"2026-11-12","epss":0.00186,"percentile":0.08308}],"risk":0.083235,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56392","description":"GNU coreutils unexpand is vulnerable to a heap-based buffer overflow due to an integer overflow during buffer allocation when processing large tab stop (-t) values. The multiplication used to calculate the allocation size can wrap around, resulting in an undersized buffer.\nWhen processing crafted input, subsequent writes exceed the allocated memory, leading to an out‑of‑bounds heap write.\n\nWhen running GNU coreutils unexpand with attacker-provided large tab stop (-t) arguments, this behavior leads to a crash and potentially achieve a heap write primitive depending on memory layout.\n\n\n\n\n\n\n\n\n\n\nThis issue has been fixed in the commit b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d"},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119372","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119372","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119372","cwe":"CWE-416","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119372","date":"2026-11-12","epss":0.00147,"percentile":0.04011}],"risk":0.0819525,"urls":["https://abraxaslabs.tech/research/sqlite-fts3-snippet","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/ext/fts3/fts3_snippet.c#L561","https://github.com/sqlite/sqlite/commit/a87bd2471a9c0606e78d3c3678bcd9cecaa0e731","https://sqlite.org/bugs/info/2026-08-17T09:18:24Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/e4635c4153","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-use-after-free-in-fts3-fts3bestsnippet-via-snippet"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119372","description":"SQLite before 3.54.0 built with FTS3/FTS4 and SQLITE_ENABLE_FTS3_PARENTHESIS contains a use-after-free vulnerability in fts3BestSnippet() caused by dangling cached position-list pointers. Attackers can run a full-text MATCH query combining OR and NEAR operators with snippet() to read freed heap memory and crash the process."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-113408","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-113408","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"risk":0.08064,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-113408"},"relatedVulnerabilities":[{"id":"CVE-2026-113408","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-113408","cwe":"CWE-22","type":"Primary","source":"cve@gitlab.com"}],"epss":[{"cve":"CVE-2026-113408","date":"2026-11-12","epss":0.00256,"percentile":0.17408}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/809"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-113408","description":"Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository"}]},{"artifact":{"id":"6921667c3af65467","cpes":["cpe:2.3:a:coreutils:coreutils:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils","purl":"pkg:apk/alpine/coreutils@9.11-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/bin"},{"path":"/bin/base64"},{"path":"/bin/cat"},{"path":"/bin/chgrp"},{"path":"/bin/chmod"},{"path":"/bin/chown"},{"path":"/bin/coreutils"},{"path":"/bin/cp"},{"path":"/bin/date"},{"path":"/bin/dd"},{"path":"/bin/df"},{"path":"/bin/echo"},{"path":"/bin/false"},{"path":"/bin/link"},{"path":"/bin/ln"},{"path":"/bin/ls"},{"path":"/bin/mkdir"},{"path":"/bin/mknod"},{"path":"/bin/mktemp"},{"path":"/bin/mv"},{"path":"/bin/nice"},{"path":"/bin/printenv"},{"path":"/bin/pwd"},{"path":"/bin/rm"},{"path":"/bin/rmdir"},{"path":"/bin/sleep"},{"path":"/bin/stat"},{"path":"/bin/stty"},{"path":"/bin/sync"},{"path":"/bin/touch"},{"path":"/bin/true"},{"path":"/bin/uname"},{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/["},{"path":"/usr/bin/b2sum"},{"path":"/usr/bin/base32"},{"path":"/usr/bin/basename"},{"path":"/usr/bin/basenc"},{"path":"/usr/bin/cksum"},{"path":"/usr/bin/comm"},{"path":"/usr/bin/csplit"},{"path":"/usr/bin/cut"},{"path":"/usr/bin/dir"},{"path":"/usr/bin/dircolors"},{"path":"/usr/bin/dirname"},{"path":"/usr/bin/du"},{"path":"/usr/bin/expand"},{"path":"/usr/bin/expr"},{"path":"/usr/bin/factor"},{"path":"/usr/bin/fold"},{"path":"/usr/bin/head"},{"path":"/usr/bin/hostid"},{"path":"/usr/bin/id"},{"path":"/usr/bin/install"},{"path":"/usr/bin/join"},{"path":"/usr/bin/logname"},{"path":"/usr/bin/md5sum"},{"path":"/usr/bin/mkfifo"},{"path":"/usr/bin/nl"},{"path":"/usr/bin/nohup"},{"path":"/usr/bin/nproc"},{"path":"/usr/bin/numfmt"},{"path":"/usr/bin/od"},{"path":"/usr/bin/paste"},{"path":"/usr/bin/pathchk"},{"path":"/usr/bin/pinky"},{"path":"/usr/bin/pr"},{"path":"/usr/bin/printf"},{"path":"/usr/bin/ptx"},{"path":"/usr/bin/readlink"},{"path":"/usr/bin/realpath"},{"path":"/usr/bin/seq"},{"path":"/usr/bin/sha1sum"},{"path":"/usr/bin/sha224sum"},{"path":"/usr/bin/sha256sum"},{"path":"/usr/bin/sha384sum"},{"path":"/usr/bin/shred"},{"path":"/usr/bin/shuf"},{"path":"/usr/bin/sort"},{"path":"/usr/bin/split"},{"path":"/usr/bin/stdbuf"},{"path":"/usr/bin/sum"},{"path":"/usr/bin/tac"},{"path":"/usr/bin/tail"},{"path":"/usr/bin/tee"},{"path":"/usr/bin/test"},{"path":"/usr/bin/timeout"},{"path":"/usr/bin/tr"},{"path":"/usr/bin/truncate"},{"path":"/usr/bin/tsort"},{"path":"/usr/bin/tty"},{"path":"/usr/bin/unexpand"},{"path":"/usr/bin/uniq"},{"path":"/usr/bin/unlink"},{"path":"/usr/bin/users"},{"path":"/usr/bin/vdir"},{"path":"/usr/bin/wc"},{"path":"/usr/bin/who"},{"path":"/usr/bin/whoami"},{"path":"/usr/bin/yes"},{"path":"/usr/libexec"},{"path":"/usr/libexec/coreutils"},{"path":"/usr/libexec/coreutils/libstdbuf.so"},{"path":"/usr/sbin"},{"path":"/usr/sbin/chroot"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"16361c4de507bb4c","cpes":["cpe:2.3:a:coreutils-env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_env:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-env:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_env:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-env","purl":"pkg:apk/alpine/coreutils-env@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/env"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"0c43a637992609b6","cpes":["cpe:2.3:a:coreutils-fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_fmt:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-fmt:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_fmt:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-fmt","purl":"pkg:apk/alpine/coreutils-fmt@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/fmt"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"157238390cea3b89","cpes":["cpe:2.3:a:coreutils-sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils-sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils_sha512sum:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:coreutils:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils-sha512sum:9.11-r0:*:*:*:*:*:*:*","cpe:2.3:a:gnu:coreutils_sha512sum:9.11-r0:*:*:*:*:*:*:*"],"name":"coreutils-sha512sum","purl":"pkg:apk/alpine/coreutils-sha512sum@9.11-r0?arch=x86_64&distro=alpine-3.24.3&upstream=coreutils","type":"apk","version":"9.11-r0","language":"","licenses":["GPL-3.0-or-later"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/sha512sum"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"coreutils"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:gnu:coreutils:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-56391","versionConstraint":">= 9.5, <= 9.11 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:gnu:coreutils:9.11:*:*:*:*:*:*:*"],"package":{"name":"coreutils","version":"9.11-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-56391","fix":{"state":"","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H","metrics":{"baseScore":6.1,"impactScore":4.3,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":4.6},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56391","cwe":"CWE-125","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-56391","date":"2026-11-12","epss":0.00131,"percentile":0.02761}],"risk":0.06779249999999999,"urls":["https://cert.pl/en/posts/2026/07/CVE-2026-56391","https://git.savannah.gnu.org/cgit/coreutils.git/","https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=d64e35a8a4c0e4608321433e0d84d917e4e36371"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56391","description":"GNU coreutils uniq is vulnerable to an out‑of‑bounds read due to incorrect handling of multibyte input when the -w (--check-chars) option is used. The find_field() function miscalculates the byte length of characters by repeatedly processing a fixed pointer instead of advancing through the input, resulting in an inflated length value. \nThis incorrect length is later used in a memcmp operation, causing reads beyond the allocated buffer when processing crafted multibyte input.\n\nWhen running GNU coreutils uniq with attacker-provided arguments, this behavior leads to a crash and potential adjacent heap memory exposure.\n\n\nThis issue has been fixed in the commit d64e35a8a4c0e4608321433e0d84d917e4e36371."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100407","versionConstraint":">= 2.44.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100407","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100407","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100407","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/52ca1113d651127f89477a8763f86ab20f645e1d","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-v3h4-vrpr-rh9x"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100407","description":"Git for Windows is the Windows port of Git. From 2.44.0.windows.1 until 2.55.0.windows.3, the git-credential-wincred store operation in contrib/credential/wincred/git-credential-wincred.c uses _scwprintf() to size a formatted wide-character credential buffer without space for the terminating NUL when both password and oauth_refresh_token are present. The operation also passes a byte count to _snwprintf_s() where a wide-character count is required, allowing the terminator to be written one WCHAR past the heap allocation before CredWriteW() persists the credential. The resulting fixed two-byte NUL overwrite can terminate the helper with Windows heap-corruption status and can cause git credential approve to report success even though the OAuth credential was not stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:git-scm:git:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-100408","versionConstraint":">= 2.43.0.windows.1, < 2.55.0.windows.3 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:git-scm:git:2.54.0:*:*:*:*:*:*:*"],"package":{"name":"git","version":"2.54.0-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-100408","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100408","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-100408","date":"2026-11-12","epss":0.00117,"percentile":0.01667}],"risk":0.05499000000000001,"urls":["https://github.com/git-for-windows/git/commit/b4d1fb62c7e2fdcab5a018e25e51acb196eb1756","https://github.com/git-for-windows/git/releases/tag/v2.55.0.windows.3","https://github.com/git-for-windows/git/security/advisories/GHSA-5j7x-r6vf-jhq2"],"severity":"Medium","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100408","description":"Git for Windows is the Windows port of Git. From 2.43.0.windows.1 until 2.55.0.windows.3, when a matching git:* credential exists in Windows Credential Manager and a git-credential-wincred erase input includes a password field, the operation in contrib/credential/wincred/git-credential-wincred.c allocates a buffer of exactly CredentialBlobSize bytes in match_cred_password() and then uses wcsncpy_s() to copy the corresponding number of wide characters plus a terminating NUL. The destination capacity is also supplied in bytes instead of WCHAR elements, allowing a fixed two-byte NUL write past the allocation before the password comparison determines whether CredDeleteW() should remove the credential; erase without a password field does not enter this comparison path. The helper can terminate with Windows heap-corruption status, and git credential reject can appear successful while the rejected credential remains stored. This issue is fixed in version 2.55.0.windows.3."},"relatedVulnerabilities":[]},{"artifact":{"id":"1a67e55521b4ee38","cpes":["cpe:2.3:a:sqlite-libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite-libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite_libs:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite-libs:3.53.4-r0:*:*:*:*:*:*:*","cpe:2.3:a:sqlite:sqlite_libs:3.53.4-r0:*:*:*:*:*:*:*"],"name":"sqlite-libs","purl":"pkg:apk/alpine/sqlite-libs@3.53.4-r0?arch=x86_64&distro=alpine-3.24.3&upstream=sqlite","type":"apk","version":"3.53.4-r0","language":"","licenses":["blessing"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libsqlite3.so.0"},{"path":"/usr/lib/libsqlite3.so.3.53.4"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"sqlite"}],"metadataType":"ApkMetadata"},"matchDetails":[{"type":"cpe-match","found":{"cpes":["cpe:2.3:a:sqlite:sqlite:*:*:*:*:*:*:*:*"],"vulnerabilityID":"CVE-2026-119377","versionConstraint":"< 3.54.0 (unknown)"},"matcher":"apk-matcher","searchedBy":{"cpes":["cpe:2.3:a:sqlite:sqlite:3.53.4:*:*:*:*:*:*:*"],"package":{"name":"sqlite","version":"3.53.4-r0"},"namespace":"nvd:cpe"}}],"vulnerability":{"id":"CVE-2026-119377","fix":{"state":"unknown","versions":[]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.5,"impactScore":1.5,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-119377","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-119377","date":"2026-11-12","epss":0.00129,"percentile":0.02546}],"risk":0.03612,"urls":["https://abraxaslabs.tech/research/sqlite-fj-using-auth","https://github.com/sqlite/sqlite","https://github.com/sqlite/sqlite/blob/version-3.53.4/src/resolve.c#L775","https://github.com/sqlite/sqlite/commit/5694c3bb2a6a40770ecd2f65910eea756734dfd8","https://github.com/sqlite/sqlite/commit/7ff247c5b9ead3ad8a69c26d3fd264878e127237","https://sqlite.org/bugs/info/2026-07-05T08:15:45Z","https://sqlite.org/releaselog/3_54_0.html","https://sqlite.org/src/info/2cb22877683680c1","https://sqlite.org/src/info/bbd69ce274620008","https://www.vulncheck.com/advisories/sqlite-before-3.54.0-authorizer-bypass-via-right-or-full-join-using"],"severity":"Low","namespace":"nvd:cpe","advisories":[],"dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-119377","description":"SQLite before 3.54.0 contains an authorization bypass vulnerability in lookupName() that invokes the authorizer only for the first joined table's USING column. Attackers able to submit SQL can query a shared USING column in a RIGHT or FULL JOIN to read columns denied via sqlite3_set_authorizer() SQLITE_READ restrictions."},"relatedVulnerabilities":[]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116304","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116304","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116304"},"relatedVulnerabilities":[{"id":"CVE-2026-116304","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116304","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116304","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116304/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116304","description":"Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116306","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116306","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116306"},"relatedVulnerabilities":[{"id":"CVE-2026-116306","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116306","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116306/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116306","description":"Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116307","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116307","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116307"},"relatedVulnerabilities":[{"id":"CVE-2026-116307","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116307","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116307/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116307","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116309","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116309","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116309"},"relatedVulnerabilities":[{"id":"CVE-2026-116309","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116309","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116309/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116309","description":"Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY.  We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116313","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116313","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116313"},"relatedVulnerabilities":[{"id":"CVE-2026-116313","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116313","cwe":"CWE-426","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116313/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116313","description":"Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query.  The pg_upgrade documentation recommends an affected vacuumdb invocation.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116314","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116314","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116314"},"relatedVulnerabilities":[{"id":"CVE-2026-116314","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116314","cwe":"CWE-20","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116314/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116314","description":"Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive.  Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116315","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116315","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116315"},"relatedVulnerabilities":[{"id":"CVE-2026-116315","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116315","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116315/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116315","description":"Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116316","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116316","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116316"},"relatedVulnerabilities":[{"id":"CVE-2026-116316","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116316","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116316/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116316","description":"Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp.  The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116317","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116317","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116317"},"relatedVulnerabilities":[{"id":"CVE-2026-116317","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116317","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116317/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116317","description":"Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116318","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116318","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116318"},"relatedVulnerabilities":[{"id":"CVE-2026-116318","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116318","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116318/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116318","description":"SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116319","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116319","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116319"},"relatedVulnerabilities":[{"id":"CVE-2026-116319","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116319","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116319/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116319","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116320","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116320","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116320"},"relatedVulnerabilities":[{"id":"CVE-2026-116320","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116320","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116320/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116320","description":"Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116323","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116323","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116323"},"relatedVulnerabilities":[{"id":"CVE-2026-116323","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116323","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116323/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116323","description":"Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116325","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116325","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116325"},"relatedVulnerabilities":[{"id":"CVE-2026-116325","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":5.9,"exploitabilityScore":2.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116325","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116325/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116325","description":"SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116326","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116326","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116326"},"relatedVulnerabilities":[{"id":"CVE-2026-116326","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116326","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116326/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116326","description":"Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error.  We have not ruled out arbitrary code execution on some platform.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116328","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116328","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116328"},"relatedVulnerabilities":[{"id":"CVE-2026-116328","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116328","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116328/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116328","description":"Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116329","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116329","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116329"},"relatedVulnerabilities":[{"id":"CVE-2026-116329","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116329","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116329/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116329","description":"Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116330","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116330","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116330"},"relatedVulnerabilities":[{"id":"CVE-2026-116330","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116330","cwe":"CWE-829","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116330/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116330","description":"Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql.  This is a gap in the fix for CVE-2025-8714.  restore.sql is undocumented.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116331","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116331","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116331"},"relatedVulnerabilities":[{"id":"CVE-2026-116331","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116331","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116331/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116331","description":"Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116332","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116332","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116332"},"relatedVulnerabilities":[{"id":"CVE-2026-116332","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116332","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116332/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116332","description":"Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116335","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116335","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116335"},"relatedVulnerabilities":[{"id":"CVE-2026-116335","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116335","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116335/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116335","description":"Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116336","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116336","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116336"},"relatedVulnerabilities":[{"id":"CVE-2026-116336","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116336","cwe":"CWE-672","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"},{"cve":"CVE-2026-116336","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116336/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116336","description":"Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120139","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120139","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120139"},"relatedVulnerabilities":[{"id":"CVE-2026-120139","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120139","cwe":"CWE-190","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120139/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120139","description":"Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120141","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120141","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120141"},"relatedVulnerabilities":[{"id":"CVE-2026-120141","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120141","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120141/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120141","description":"Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types.  json_populate_recordset() is one affected function.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120142","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120142","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120142"},"relatedVulnerabilities":[{"id":"CVE-2026-120142","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120142","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120142/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120142","description":"Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120143","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120143","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120143"},"relatedVulnerabilities":[{"id":"CVE-2026-120143","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120143","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120143/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120143","description":"Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120144","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120144","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120144"},"relatedVulnerabilities":[{"id":"CVE-2026-120144","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120144","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120144/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120144","description":"Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120145","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120145","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120145"},"relatedVulnerabilities":[{"id":"CVE-2026-120145","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120145","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120145/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120145","description":"Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target.  Only subscriptions owned by a superuser are vulnerable.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120147","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120147","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120147"},"relatedVulnerabilities":[{"id":"CVE-2026-120147","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120147","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120147/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120147","description":"Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120148","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120148","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120148"},"relatedVulnerabilities":[{"id":"CVE-2026-120148","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120148","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120148/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120148","description":"Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120149","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120149","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120149"},"relatedVulnerabilities":[{"id":"CVE-2026-120149","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120149","cwe":"CWE-122","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120149/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120149","description":"Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied.  postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120150","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120150","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120150"},"relatedVulnerabilities":[{"id":"CVE-2026-120150","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120150","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120150/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120150","description":"Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120151","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120151","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120151"},"relatedVulnerabilities":[{"id":"CVE-2026-120151","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120151","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120151/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120151","description":"Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120153","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120153","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120153"},"relatedVulnerabilities":[{"id":"CVE-2026-120153","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120153","cwe":"CWE-89","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120153/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120153","description":"SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings.  This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-14661","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-14661","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-14661"},"relatedVulnerabilities":[{"id":"CVE-2026-14661","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14661","cwe":"CWE-73","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-14661/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14661","description":"External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file.  Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing.  This \"sslkeylogfile\" mechanism cannot add arbitrary bytes.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-18447","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-18447","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-18447"},"relatedVulnerabilities":[{"id":"CVE-2026-18447","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-18447","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-18447/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-18447","description":"Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\".  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6460","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6460","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6460"},"relatedVulnerabilities":[{"id":"CVE-2026-6460","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6460","cwe":"CWE-843","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6460/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6460","description":"Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily.  Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\".  The system had inadequate tracking of typed values, and values were not self-identifying.  Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system.  PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6467","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-6467","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"High","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-6467"},"relatedVulnerabilities":[{"id":"CVE-2026-6467","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6467","cwe":"CWE-427","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-6467/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6467","description":"Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\".  ALTER EXTENSION was also affected.  A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114466","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114466","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114466"},"relatedVulnerabilities":[{"id":"CVE-2026-114466","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114466","cwe":"CWE-1220","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/812"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114466","description":"Arbitrary data can be read or written through git-fast-import(1) and git-fast-export(1) features not marked unsafe"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114469","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114469","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114469"},"relatedVulnerabilities":[{"id":"CVE-2026-114469","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L","metrics":{"baseScore":4.4,"impactScore":2.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114469","cwe":"CWE-125","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/811"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114469","description":"Out-of-bounds read can crash git-apply(1) when binary patch inflates to very large size"}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116308","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116308","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116308"},"relatedVulnerabilities":[{"id":"CVE-2026-116308","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116308","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116308/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116308","description":"Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116310","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116310","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116310"},"relatedVulnerabilities":[{"id":"CVE-2026-116310","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116310","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116310/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116310","description":"Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error.  file_fdw reaches the same code path in affected version 18.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116311","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116311","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116311"},"relatedVulnerabilities":[{"id":"CVE-2026-116311","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116311","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116311/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116311","description":"Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116312","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116312","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116312"},"relatedVulnerabilities":[{"id":"CVE-2026-116312","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116312","cwe":"CWE-1250","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116312/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116312","description":"Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE.  Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected.  Versions before PostgreSQL 15 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116321","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116321","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116321"},"relatedVulnerabilities":[{"id":"CVE-2026-116321","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116321","cwe":"CWE-170","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116321/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116321","description":"Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116322","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116322","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116322"},"relatedVulnerabilities":[{"id":"CVE-2026-116322","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116322","cwe":"CWE-667","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116322/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116322","description":"Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling.  Within major version 18, minor versions before PostgreSQL 18.7 are affected.  Versions before PostgreSQL 18 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116327","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116327","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116327"},"relatedVulnerabilities":[{"id":"CVE-2026-116327","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116327","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116327/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116327","description":"Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116333","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116333","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116333"},"relatedVulnerabilities":[{"id":"CVE-2026-116333","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116333","cwe":"CWE-126","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116333/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116333","description":"Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays.  Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected.  Versions before PostgreSQL 17 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120146","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120146","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120146"},"relatedVulnerabilities":[{"id":"CVE-2026-120146","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120146","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120146/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120146","description":"Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role.  It also allows reassignment of database ownership without the CREATEDB privilege.  The equivalent ALTER ... OWNER commands block this.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120152","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120152","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120152"},"relatedVulnerabilities":[{"id":"CVE-2026-120152","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120152","cwe":"CWE-416","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120152/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120152","description":"Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees.  Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected.  Versions before PostgreSQL 16 are unaffected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-120154","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-120154","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-120154"},"relatedVulnerabilities":[{"id":"CVE-2026-120154","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-120154","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-120154/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-120154","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE.  Unlike CVE-2026-16237, this does not facilitate improper writes.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16237","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16237","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Medium","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16237"},"relatedVulnerabilities":[{"id":"CVE-2026-16237","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16237","cwe":"CWE-424","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16237/"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16237","description":"Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE.  This bypasses the view's WHERE condition, whether or not the view is a security_barrier view.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114467","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-114467","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-114467"},"relatedVulnerabilities":[{"id":"CVE-2026-114467","cvss":[{"type":"Secondary","source":"cve@gitlab.com","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.3,"impactScore":1.5,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114467","cwe":"CWE-787","type":"Primary","source":"cve@gitlab.com"}],"urls":["https://gitlab.com/gitlab-org/git/-/work_items/810"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114467","description":"Out-of-bounds write possible in Git when git-merge(1) used on tag with more than two GPG signatures"}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-116303","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-116303","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-116303"},"relatedVulnerabilities":[{"id":"CVE-2026-116303","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.1,"impactScore":1.5,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-116303","cwe":"CWE-862","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-116303/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-116303","description":"Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others.  A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found.  There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"75b26e9d70984758","cpes":["cpe:2.3:a:libpq:libpq:18.6-r0:*:*:*:*:*:*:*"],"name":"libpq","purl":"pkg:apk/alpine/libpq@18.6-r0?arch=x86_64&distro=alpine-3.24.3&upstream=postgresql18","type":"apk","version":"18.6-r0","language":"","licenses":["PostgreSQL"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/lib"},{"path":"/usr/lib/libpq.so.5"},{"path":"/usr/lib/libpq.so.5.18"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"postgresql18"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"18.7-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-16240","versionConstraint":"< 18.7-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"postgresql18","version":"18.6-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-16240","fix":{"state":"fixed","versions":["18.7-r0"],"available":[{"date":"2026-11-13","kind":"first-observed","version":"18.7-r0"}]},"cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"risk":0,"urls":[],"severity":"Low","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-16240"},"relatedVulnerabilities":[{"id":"CVE-2026-16240","cvss":[{"type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-16240","cwe":"CWE-134","type":"Secondary","source":"f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"}],"urls":["https://www.postgresql.org/support/security/CVE-2026-16240/"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-16240","description":"Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes.  The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that.  Integrity impact is unlikely; in particular, the applicable formatter does not support %n.  Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."}]},{"artifact":{"id":"47430c00a831c822","cpes":["cpe:2.3:a:git-scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_scm:git:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git","purl":"pkg:apk/alpine/git@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/bin"},{"path":"/usr/bin/git"},{"path":"/usr/bin/git-receive-pack"},{"path":"/usr/bin/git-shell"},{"path":"/usr/bin/git-upload-archive"},{"path":"/usr/bin/git-upload-pack"},{"path":"/usr/libexec"},{"path":"/usr/libexec/git-core"},{"path":"/usr/libexec/git-core/git"},{"path":"/usr/libexec/git-core/git-add"},{"path":"/usr/libexec/git-core/git-am"},{"path":"/usr/libexec/git-core/git-annotate"},{"path":"/usr/libexec/git-core/git-apply"},{"path":"/usr/libexec/git-core/git-archive"},{"path":"/usr/libexec/git-core/git-backfill"},{"path":"/usr/libexec/git-core/git-bisect"},{"path":"/usr/libexec/git-core/git-blame"},{"path":"/usr/libexec/git-core/git-branch"},{"path":"/usr/libexec/git-core/git-bugreport"},{"path":"/usr/libexec/git-core/git-bundle"},{"path":"/usr/libexec/git-core/git-cat-file"},{"path":"/usr/libexec/git-core/git-check-attr"},{"path":"/usr/libexec/git-core/git-check-ignore"},{"path":"/usr/libexec/git-core/git-check-mailmap"},{"path":"/usr/libexec/git-core/git-check-ref-format"},{"path":"/usr/libexec/git-core/git-checkout"},{"path":"/usr/libexec/git-core/git-checkout--worker"},{"path":"/usr/libexec/git-core/git-checkout-index"},{"path":"/usr/libexec/git-core/git-cherry"},{"path":"/usr/libexec/git-core/git-cherry-pick"},{"path":"/usr/libexec/git-core/git-clean"},{"path":"/usr/libexec/git-core/git-clone"},{"path":"/usr/libexec/git-core/git-column"},{"path":"/usr/libexec/git-core/git-commit"},{"path":"/usr/libexec/git-core/git-commit-graph"},{"path":"/usr/libexec/git-core/git-commit-tree"},{"path":"/usr/libexec/git-core/git-config"},{"path":"/usr/libexec/git-core/git-count-objects"},{"path":"/usr/libexec/git-core/git-credential"},{"path":"/usr/libexec/git-core/git-credential-cache"},{"path":"/usr/libexec/git-core/git-credential-cache--daemon"},{"path":"/usr/libexec/git-core/git-credential-store"},{"path":"/usr/libexec/git-core/git-describe"},{"path":"/usr/libexec/git-core/git-diagnose"},{"path":"/usr/libexec/git-core/git-diff"},{"path":"/usr/libexec/git-core/git-diff-files"},{"path":"/usr/libexec/git-core/git-diff-index"},{"path":"/usr/libexec/git-core/git-diff-pairs"},{"path":"/usr/libexec/git-core/git-diff-tree"},{"path":"/usr/libexec/git-core/git-difftool"},{"path":"/usr/libexec/git-core/git-difftool--helper"},{"path":"/usr/libexec/git-core/git-fast-export"},{"path":"/usr/libexec/git-core/git-fetch"},{"path":"/usr/libexec/git-core/git-fetch-pack"},{"path":"/usr/libexec/git-core/git-filter-branch"},{"path":"/usr/libexec/git-core/git-fmt-merge-msg"},{"path":"/usr/libexec/git-core/git-for-each-ref"},{"path":"/usr/libexec/git-core/git-for-each-repo"},{"path":"/usr/libexec/git-core/git-format-patch"},{"path":"/usr/libexec/git-core/git-fsck"},{"path":"/usr/libexec/git-core/git-fsck-objects"},{"path":"/usr/libexec/git-core/git-fsmonitor--daemon"},{"path":"/usr/libexec/git-core/git-gc"},{"path":"/usr/libexec/git-core/git-get-tar-commit-id"},{"path":"/usr/libexec/git-core/git-grep"},{"path":"/usr/libexec/git-core/git-gui--askyesno"},{"path":"/usr/libexec/git-core/git-hash-object"},{"path":"/usr/libexec/git-core/git-help"},{"path":"/usr/libexec/git-core/git-history"},{"path":"/usr/libexec/git-core/git-hook"},{"path":"/usr/libexec/git-core/git-http-fetch"},{"path":"/usr/libexec/git-core/git-http-push"},{"path":"/usr/libexec/git-core/git-index-pack"},{"path":"/usr/libexec/git-core/git-init"},{"path":"/usr/libexec/git-core/git-init-db"},{"path":"/usr/libexec/git-core/git-interpret-trailers"},{"path":"/usr/libexec/git-core/git-last-modified"},{"path":"/usr/libexec/git-core/git-log"},{"path":"/usr/libexec/git-core/git-ls-files"},{"path":"/usr/libexec/git-core/git-ls-remote"},{"path":"/usr/libexec/git-core/git-ls-tree"},{"path":"/usr/libexec/git-core/git-mailinfo"},{"path":"/usr/libexec/git-core/git-mailsplit"},{"path":"/usr/libexec/git-core/git-maintenance"},{"path":"/usr/libexec/git-core/git-merge"},{"path":"/usr/libexec/git-core/git-merge-base"},{"path":"/usr/libexec/git-core/git-merge-file"},{"path":"/usr/libexec/git-core/git-merge-index"},{"path":"/usr/libexec/git-core/git-merge-octopus"},{"path":"/usr/libexec/git-core/git-merge-one-file"},{"path":"/usr/libexec/git-core/git-merge-ours"},{"path":"/usr/libexec/git-core/git-merge-recursive"},{"path":"/usr/libexec/git-core/git-merge-resolve"},{"path":"/usr/libexec/git-core/git-merge-subtree"},{"path":"/usr/libexec/git-core/git-merge-tree"},{"path":"/usr/libexec/git-core/git-mergetool"},{"path":"/usr/libexec/git-core/git-mergetool--lib"},{"path":"/usr/libexec/git-core/git-mktag"},{"path":"/usr/libexec/git-core/git-mktree"},{"path":"/usr/libexec/git-core/git-multi-pack-index"},{"path":"/usr/libexec/git-core/git-mv"},{"path":"/usr/libexec/git-core/git-name-rev"},{"path":"/usr/libexec/git-core/git-notes"},{"path":"/usr/libexec/git-core/git-pack-objects"},{"path":"/usr/libexec/git-core/git-pack-redundant"},{"path":"/usr/libexec/git-core/git-pack-refs"},{"path":"/usr/libexec/git-core/git-patch-id"},{"path":"/usr/libexec/git-core/git-prune"},{"path":"/usr/libexec/git-core/git-prune-packed"},{"path":"/usr/libexec/git-core/git-pull"},{"path":"/usr/libexec/git-core/git-push"},{"path":"/usr/libexec/git-core/git-quiltimport"},{"path":"/usr/libexec/git-core/git-range-diff"},{"path":"/usr/libexec/git-core/git-read-tree"},{"path":"/usr/libexec/git-core/git-rebase"},{"path":"/usr/libexec/git-core/git-receive-pack"},{"path":"/usr/libexec/git-core/git-reflog"},{"path":"/usr/libexec/git-core/git-refs"},{"path":"/usr/libexec/git-core/git-remote"},{"path":"/usr/libexec/git-core/git-remote-ext"},{"path":"/usr/libexec/git-core/git-remote-fd"},{"path":"/usr/libexec/git-core/git-remote-ftp"},{"path":"/usr/libexec/git-core/git-remote-ftps"},{"path":"/usr/libexec/git-core/git-remote-http"},{"path":"/usr/libexec/git-core/git-remote-https"},{"path":"/usr/libexec/git-core/git-repack"},{"path":"/usr/libexec/git-core/git-replace"},{"path":"/usr/libexec/git-core/git-replay"},{"path":"/usr/libexec/git-core/git-repo"},{"path":"/usr/libexec/git-core/git-request-pull"},{"path":"/usr/libexec/git-core/git-rerere"},{"path":"/usr/libexec/git-core/git-reset"},{"path":"/usr/libexec/git-core/git-restore"},{"path":"/usr/libexec/git-core/git-rev-list"},{"path":"/usr/libexec/git-core/git-rev-parse"},{"path":"/usr/libexec/git-core/git-revert"},{"path":"/usr/libexec/git-core/git-rm"},{"path":"/usr/libexec/git-core/git-send-pack"},{"path":"/usr/libexec/git-core/git-sh-i18n"},{"path":"/usr/libexec/git-core/git-sh-i18n--envsubst"},{"path":"/usr/libexec/git-core/git-sh-setup"},{"path":"/usr/libexec/git-core/git-shortlog"},{"path":"/usr/libexec/git-core/git-show"},{"path":"/usr/libexec/git-core/git-show-branch"},{"path":"/usr/libexec/git-core/git-show-index"},{"path":"/usr/libexec/git-core/git-show-ref"},{"path":"/usr/libexec/git-core/git-sparse-checkout"},{"path":"/usr/libexec/git-core/git-stage"},{"path":"/usr/libexec/git-core/git-stash"},{"path":"/usr/libexec/git-core/git-status"},{"path":"/usr/libexec/git-core/git-stripspace"},{"path":"/usr/libexec/git-core/git-submodule"},{"path":"/usr/libexec/git-core/git-submodule--helper"},{"path":"/usr/libexec/git-core/git-switch"},{"path":"/usr/libexec/git-core/git-symbolic-ref"},{"path":"/usr/libexec/git-core/git-tag"},{"path":"/usr/libexec/git-core/git-unpack-file"},{"path":"/usr/libexec/git-core/git-unpack-objects"},{"path":"/usr/libexec/git-core/git-update-index"},{"path":"/usr/libexec/git-core/git-update-ref"},{"path":"/usr/libexec/git-core/git-update-server-info"},{"path":"/usr/libexec/git-core/git-upload-archive"},{"path":"/usr/libexec/git-core/git-upload-pack"},{"path":"/usr/libexec/git-core/git-var"},{"path":"/usr/libexec/git-core/git-verify-commit"},{"path":"/usr/libexec/git-core/git-verify-pack"},{"path":"/usr/libexec/git-core/git-verify-tag"},{"path":"/usr/libexec/git-core/git-version"},{"path":"/usr/libexec/git-core/git-web--browse"},{"path":"/usr/libexec/git-core/git-whatchanged"},{"path":"/usr/libexec/git-core/git-worktree"},{"path":"/usr/libexec/git-core/git-write-tree"},{"path":"/usr/libexec/git-core/mergetools"},{"path":"/usr/libexec/git-core/mergetools/araxis"},{"path":"/usr/libexec/git-core/mergetools/bc"},{"path":"/usr/libexec/git-core/mergetools/codecompare"},{"path":"/usr/libexec/git-core/mergetools/deltawalker"},{"path":"/usr/libexec/git-core/mergetools/diffmerge"},{"path":"/usr/libexec/git-core/mergetools/diffuse"},{"path":"/usr/libexec/git-core/mergetools/ecmerge"},{"path":"/usr/libexec/git-core/mergetools/emerge"},{"path":"/usr/libexec/git-core/mergetools/examdiff"},{"path":"/usr/libexec/git-core/mergetools/guiffy"},{"path":"/usr/libexec/git-core/mergetools/gvimdiff"},{"path":"/usr/libexec/git-core/mergetools/kdiff3"},{"path":"/usr/libexec/git-core/mergetools/kompare"},{"path":"/usr/libexec/git-core/mergetools/meld"},{"path":"/usr/libexec/git-core/mergetools/nvimdiff"},{"path":"/usr/libexec/git-core/mergetools/opendiff"},{"path":"/usr/libexec/git-core/mergetools/smerge"},{"path":"/usr/libexec/git-core/mergetools/tkdiff"},{"path":"/usr/libexec/git-core/mergetools/tortoisemerge"},{"path":"/usr/libexec/git-core/mergetools/vimdiff"},{"path":"/usr/libexec/git-core/mergetools/vscode"},{"path":"/usr/libexec/git-core/mergetools/winmerge"},{"path":"/usr/libexec/git-core/mergetools/xxdiff"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}},{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]},{"artifact":{"id":"9c74e5fd85350dce","cpes":["cpe:2.3:a:git-init-template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init-template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init_template:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git-init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git_init:git_init_template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git-init-template:2.54.0-r0:*:*:*:*:*:*:*","cpe:2.3:a:git:git_init_template:2.54.0-r0:*:*:*:*:*:*:*"],"name":"git-init-template","purl":"pkg:apk/alpine/git-init-template@2.54.0-r0?arch=x86_64&distro=alpine-3.24.3&upstream=git","type":"apk","version":"2.54.0-r0","language":"","licenses":["GPL-2.0-only"],"metadata":{"Arch":"x86_64","files":[{"path":"/usr"},{"path":"/usr/share"},{"path":"/usr/share/git-core"},{"path":"/usr/share/git-core/templates"},{"path":"/usr/share/git-core/templates/description"},{"path":"/usr/share/git-core/templates/hooks"},{"path":"/usr/share/git-core/templates/hooks/applypatch-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/post-update.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-applypatch.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-merge-commit.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-push.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-rebase.sample"},{"path":"/usr/share/git-core/templates/hooks/pre-receive.sample"},{"path":"/usr/share/git-core/templates/hooks/prepare-commit-msg.sample"},{"path":"/usr/share/git-core/templates/hooks/push-to-checkout.sample"},{"path":"/usr/share/git-core/templates/hooks/sendemail-validate.sample"},{"path":"/usr/share/git-core/templates/hooks/update.sample"},{"path":"/usr/share/git-core/templates/info"},{"path":"/usr/share/git-core/templates/info/exclude"}]},"locations":[{"path":"/lib/apk/db/installed","layerID":"sha256:d2b20418c5df6ce41e611a28ffb0a4f23550161dd7a06a7bab6fee749365cd3f","accessPath":"/lib/apk/db/installed","annotations":{"evidence":"primary"}}],"upstreams":[{"name":"git"}],"metadataType":"ApkMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"2.54.1-r0"},"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-111760","versionConstraint":"< 2.54.1-r0 (apk)"},"matcher":"apk-matcher","searchedBy":{"distro":{"type":"alpine","version":"3.24.3"},"package":{"name":"git","version":"2.54.0-r0"},"namespace":"alpine:distro:alpine:3.24"}}],"vulnerability":{"id":"CVE-2026-111760","fix":{"state":"fixed","versions":["2.54.1-r0"],"available":[{"date":"2026-11-11","kind":"first-observed","version":"2.54.1-r0"}]},"cvss":[],"risk":0,"urls":[],"severity":"Unknown","namespace":"alpine:distro:alpine:3.24","advisories":[],"dataSource":"https://security.alpinelinux.org/vuln/CVE-2026-111760"},"relatedVulnerabilities":[{"id":"CVE-2026-111760","cvss":[],"urls":[],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"nvd"}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T08:45:50.461Z","grype_db_version":"2026-11-13T15:40:34.000Z"}