{"grype_matches":[{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4341","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4341","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-25","epss":0.02292,"percentile":0.83112}],"risk":1.719,"urls":["https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736712","description":"The net/url package does not set a limit on the number of query parameters in a query.\n\nWhile the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61726","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2025-61726","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2025-61726","date":"2026-10-25","epss":0.02292,"percentile":0.83112}],"urls":["https://go.dev/cl/736712","https://go.dev/issue/77101","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4341","https://access.redhat.com/errata/RHSA-2026:10096","https://access.redhat.com/errata/RHSA-2026:10104","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:11408","https://access.redhat.com/errata/RHSA-2026:11414","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12279","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13542","https://access.redhat.com/errata/RHSA-2026:13548","https://access.redhat.com/errata/RHSA-2026:13571","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:15984","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17446","https://access.redhat.com/errata/RHSA-2026:17460","https://access.redhat.com/errata/RHSA-2026:17463","https://access.redhat.com/errata/RHSA-2026:17468","https://access.redhat.com/errata/RHSA-2026:17595","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:18913","https://access.redhat.com/errata/RHSA-2026:19013","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19712","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26420","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:2681","https://access.redhat.com/errata/RHSA-2026:2706","https://access.redhat.com/errata/RHSA-2026:2708","https://access.redhat.com/errata/RHSA-2026:2709","https://access.redhat.com/errata/RHSA-2026:2754","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:2844","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:2914","https://access.redhat.com/errata/RHSA-2026:2920","https://access.redhat.com/errata/RHSA-2026:3035","https://access.redhat.com/errata/RHSA-2026:3040","https://access.redhat.com/errata/RHSA-2026:3089","https://access.redhat.com/errata/RHSA-2026:3092","https://access.redhat.com/errata/RHSA-2026:3184","https://access.redhat.com/errata/RHSA-2026:3186","https://access.redhat.com/errata/RHSA-2026:3187","https://access.redhat.com/errata/RHSA-2026:3188","https://access.redhat.com/errata/RHSA-2026:3192","https://access.redhat.com/errata/RHSA-2026:3193","https://access.redhat.com/errata/RHSA-2026:3291","https://access.redhat.com/errata/RHSA-2026:3296","https://access.redhat.com/errata/RHSA-2026:3297","https://access.redhat.com/errata/RHSA-2026:3298","https://access.redhat.com/errata/RHSA-2026:3336","https://access.redhat.com/errata/RHSA-2026:3337","https://access.redhat.com/errata/RHSA-2026:3340","https://access.redhat.com/errata/RHSA-2026:3341","https://access.redhat.com/errata/RHSA-2026:3343","https://access.redhat.com/errata/RHSA-2026:3391","https://access.redhat.com/errata/RHSA-2026:3416","https://access.redhat.com/errata/RHSA-2026:3427","https://access.redhat.com/errata/RHSA-2026:3459","https://access.redhat.com/errata/RHSA-2026:3468","https://access.redhat.com/errata/RHSA-2026:3469","https://access.redhat.com/errata/RHSA-2026:3470","https://access.redhat.com/errata/RHSA-2026:3471","https://access.redhat.com/errata/RHSA-2026:3472","https://access.redhat.com/errata/RHSA-2026:3473","https://access.redhat.com/errata/RHSA-2026:3489","https://access.redhat.com/errata/RHSA-2026:3506","https://access.redhat.com/errata/RHSA-2026:3556","https://access.redhat.com/errata/RHSA-2026:3559","https://access.redhat.com/errata/RHSA-2026:3668","https://access.redhat.com/errata/RHSA-2026:3669","https://access.redhat.com/errata/RHSA-2026:36873","https://access.redhat.com/errata/RHSA-2026:36882","https://access.redhat.com/errata/RHSA-2026:3699","https://access.redhat.com/errata/RHSA-2026:3713","https://access.redhat.com/errata/RHSA-2026:37275","https://access.redhat.com/errata/RHSA-2026:3752","https://access.redhat.com/errata/RHSA-2026:3753","https://access.redhat.com/errata/RHSA-2026:3782","https://access.redhat.com/errata/RHSA-2026:3812","https://access.redhat.com/errata/RHSA-2026:3813","https://access.redhat.com/errata/RHSA-2026:3814","https://access.redhat.com/errata/RHSA-2026:3815","https://access.redhat.com/errata/RHSA-2026:3816","https://access.redhat.com/errata/RHSA-2026:3817","https://access.redhat.com/errata/RHSA-2026:3818","https://access.redhat.com/errata/RHSA-2026:3820","https://access.redhat.com/errata/RHSA-2026:3821","https://access.redhat.com/errata/RHSA-2026:3822","https://access.redhat.com/errata/RHSA-2026:3831","https://access.redhat.com/errata/RHSA-2026:3833","https://access.redhat.com/errata/RHSA-2026:3835","https://access.redhat.com/errata/RHSA-2026:3836","https://access.redhat.com/errata/RHSA-2026:3838","https://access.redhat.com/errata/RHSA-2026:3839","https://access.redhat.com/errata/RHSA-2026:3840","https://access.redhat.com/errata/RHSA-2026:3841","https://access.redhat.com/errata/RHSA-2026:3843","https://access.redhat.com/errata/RHSA-2026:3854","https://access.redhat.com/errata/RHSA-2026:3855","https://access.redhat.com/errata/RHSA-2026:3856","https://access.redhat.com/errata/RHSA-2026:3864","https://access.redhat.com/errata/RHSA-2026:3869","https://access.redhat.com/errata/RHSA-2026:3874","https://access.redhat.com/errata/RHSA-2026:3875","https://access.redhat.com/errata/RHSA-2026:3879","https://access.redhat.com/errata/RHSA-2026:3880","https://access.redhat.com/errata/RHSA-2026:3884","https://access.redhat.com/errata/RHSA-2026:3898","https://access.redhat.com/errata/RHSA-2026:3905","https://access.redhat.com/errata/RHSA-2026:3906","https://access.redhat.com/errata/RHSA-2026:3928","https://access.redhat.com/errata/RHSA-2026:3929","https://access.redhat.com/errata/RHSA-2026:3930","https://access.redhat.com/errata/RHSA-2026:3931","https://access.redhat.com/errata/RHSA-2026:3932","https://access.redhat.com/errata/RHSA-2026:3958","https://access.redhat.com/errata/RHSA-2026:3959","https://access.redhat.com/errata/RHSA-2026:3960","https://access.redhat.com/errata/RHSA-2026:3970","https://access.redhat.com/errata/RHSA-2026:3971","https://access.redhat.com/errata/RHSA-2026:3972","https://access.redhat.com/errata/RHSA-2026:3973","https://access.redhat.com/errata/RHSA-2026:3974","https://access.redhat.com/errata/RHSA-2026:3977","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:3985","https://access.redhat.com/errata/RHSA-2026:40924","https://access.redhat.com/errata/RHSA-2026:4164","https://access.redhat.com/errata/RHSA-2026:4166","https://access.redhat.com/errata/RHSA-2026:4170","https://access.redhat.com/errata/RHSA-2026:4174","https://access.redhat.com/errata/RHSA-2026:4177","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41941","https://access.redhat.com/errata/RHSA-2026:4211","https://access.redhat.com/errata/RHSA-2026:4220","https://access.redhat.com/errata/RHSA-2026:4256","https://access.redhat.com/errata/RHSA-2026:4264","https://access.redhat.com/errata/RHSA-2026:4267","https://access.redhat.com/errata/RHSA-2026:4270","https://access.redhat.com/errata/RHSA-2026:4276","https://access.redhat.com/errata/RHSA-2026:4434","https://access.redhat.com/errata/RHSA-2026:4435","https://access.redhat.com/errata/RHSA-2026:4460","https://access.redhat.com/errata/RHSA-2026:4466","https://access.redhat.com/errata/RHSA-2026:4467","https://access.redhat.com/errata/RHSA-2026:4498","https://access.redhat.com/errata/RHSA-2026:4500","https://access.redhat.com/errata/RHSA-2026:4510","https://access.redhat.com/errata/RHSA-2026:4511","https://access.redhat.com/errata/RHSA-2026:4672","https://access.redhat.com/errata/RHSA-2026:46903","https://access.redhat.com/errata/RHSA-2026:4753","https://access.redhat.com/errata/RHSA-2026:4892","https://access.redhat.com/errata/RHSA-2026:4901","https://access.redhat.com/errata/RHSA-2026:4907","https://access.redhat.com/errata/RHSA-2026:4939","https://access.redhat.com/errata/RHSA-2026:4942","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:4952","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5022","https://access.redhat.com/errata/RHSA-2026:5030","https://access.redhat.com/errata/RHSA-2026:5031","https://access.redhat.com/errata/RHSA-2026:5076","https://access.redhat.com/errata/RHSA-2026:5077","https://access.redhat.com/errata/RHSA-2026:5078","https://access.redhat.com/errata/RHSA-2026:5079","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:5129","https://access.redhat.com/errata/RHSA-2026:5130","https://access.redhat.com/errata/RHSA-2026:5131","https://access.redhat.com/errata/RHSA-2026:5132","https://access.redhat.com/errata/RHSA-2026:5145","https://access.redhat.com/errata/RHSA-2026:5146","https://access.redhat.com/errata/RHSA-2026:5168","https://access.redhat.com/errata/RHSA-2026:5327","https://access.redhat.com/errata/RHSA-2026:5394","https://access.redhat.com/errata/RHSA-2026:5439","https://access.redhat.com/errata/RHSA-2026:5444","https://access.redhat.com/errata/RHSA-2026:5447","https://access.redhat.com/errata/RHSA-2026:5452","https://access.redhat.com/errata/RHSA-2026:5461","https://access.redhat.com/errata/RHSA-2026:5463","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5533","https://access.redhat.com/errata/RHSA-2026:5544","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:5636","https://access.redhat.com/errata/RHSA-2026:56366","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:5645","https://access.redhat.com/errata/RHSA-2026:5649","https://access.redhat.com/errata/RHSA-2026:5665","https://access.redhat.com/errata/RHSA-2026:57013","https://access.redhat.com/errata/RHSA-2026:5807","https://access.redhat.com/errata/RHSA-2026:5851","https://access.redhat.com/errata/RHSA-2026:5852","https://access.redhat.com/errata/RHSA-2026:5853","https://access.redhat.com/errata/RHSA-2026:5948","https://access.redhat.com/errata/RHSA-2026:5950","https://access.redhat.com/errata/RHSA-2026:5952","https://access.redhat.com/errata/RHSA-2026:5968","https://access.redhat.com/errata/RHSA-2026:6184","https://access.redhat.com/errata/RHSA-2026:6192","https://access.redhat.com/errata/RHSA-2026:6226","https://access.redhat.com/errata/RHSA-2026:6251","https://access.redhat.com/errata/RHSA-2026:6277","https://access.redhat.com/errata/RHSA-2026:6278","https://access.redhat.com/errata/RHSA-2026:6428","https://access.redhat.com/errata/RHSA-2026:6429","https://access.redhat.com/errata/RHSA-2026:6497","https://access.redhat.com/errata/RHSA-2026:6554","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:6567","https://access.redhat.com/errata/RHSA-2026:6568","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:7052","https://access.redhat.com/errata/RHSA-2026:7249","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7676","https://access.redhat.com/errata/RHSA-2026:7854","https://access.redhat.com/errata/RHSA-2026:7942","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8218","https://access.redhat.com/errata/RHSA-2026:8229","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8431","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9848","https://access.redhat.com/security/cve/CVE-2025-61726","https://bugzilla.redhat.com/show_bug.cgi?id=2434432","https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-61726.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61726","description":"The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5026","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5026","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-25","epss":0.01834,"percentile":0.78763}],"risk":1.4396899999999997,"urls":["https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/767220","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error.\n\nThis behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."},"relatedVulnerabilities":[{"id":"CVE-2026-39821","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":5.8,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":9.6,"impactScore":5.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-39821","cwe":"CWE-1289","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39821","date":"2026-10-25","epss":0.01834,"percentile":0.78763}],"urls":["https://go.dev/cl/767220","https://go.dev/issue/78760","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://groups.google.com/g/golang-announce/c/iI-mYSI0lu8","https://pkg.go.dev/vuln/GO-2026-5026","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:26546","https://access.redhat.com/errata/RHSA-2026:26547","https://access.redhat.com/errata/RHSA-2026:30650","https://access.redhat.com/errata/RHSA-2026:30651","https://access.redhat.com/errata/RHSA-2026:30853","https://access.redhat.com/errata/RHSA-2026:30854","https://access.redhat.com/errata/RHSA-2026:30855","https://access.redhat.com/errata/RHSA-2026:33155","https://access.redhat.com/errata/RHSA-2026:33160","https://access.redhat.com/errata/RHSA-2026:33163","https://access.redhat.com/errata/RHSA-2026:33173","https://access.redhat.com/errata/RHSA-2026:33183","https://access.redhat.com/errata/RHSA-2026:33524","https://access.redhat.com/errata/RHSA-2026:33531","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:34789","https://access.redhat.com/errata/RHSA-2026:35826","https://access.redhat.com/errata/RHSA-2026:35827","https://access.redhat.com/errata/RHSA-2026:35828","https://access.redhat.com/errata/RHSA-2026:35829","https://access.redhat.com/errata/RHSA-2026:35830","https://access.redhat.com/errata/RHSA-2026:35831","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:36105","https://access.redhat.com/errata/RHSA-2026:36167","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:36808","https://access.redhat.com/errata/RHSA-2026:36820","https://access.redhat.com/errata/RHSA-2026:36883","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:37435","https://access.redhat.com/errata/RHSA-2026:37436","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:44624","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:52826","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54395","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54580","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56143","https://access.redhat.com/errata/RHSA-2026:56223","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56431","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57541","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59546","https://access.redhat.com/errata/RHSA-2026:59549","https://access.redhat.com/errata/RHSA-2026:59562","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61245","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:63134","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65359","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/errata/RHSA-2026:66432","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67159","https://access.redhat.com/errata/RHSA-2026:67160","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/security/cve/CVE-2026-39821","https://bugzilla.redhat.com/show_bug.cgi?id=2480756","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39821.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39821","description":"The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\"."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4337","versionConstraint":"<1.24.13||>=1.25.0-0,<1.25.7||>=1.26.0-rc.1,<1.26.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4337","fix":{"state":"fixed","versions":["1.24.13","1.25.7","1.26.0-rc.3"],"available":[{"date":"2026-02-04","kind":"release","version":"1.24.13"},{"date":"2026-02-04","kind":"release","version":"1.25.7"},{"date":"2026-02-04","kind":"release","version":"1.26.0-rc.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-25","epss":0.00915,"percentile":0.5989}],"risk":0.8692500000000001,"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-68121","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-68121","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-68121","date":"2026-10-25","epss":0.00915,"percentile":0.5989}],"urls":["https://go.dev/cl/737700","https://go.dev/issue/77217","https://groups.google.com/g/golang-announce/c/K09ubi9FQFk","https://pkg.go.dev/vuln/GO-2026-4337"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68121","description":"During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-92262","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-92262","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"risk":0.7255,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-92262"},"relatedVulnerabilities":[{"id":"CVE-2026-92262","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-92262","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-92262","date":"2026-10-25","epss":0.01451,"percentile":0.73188}],"urls":["https://github.com/MariaDB/server/commit/574ba66b2d6c5d71db83d416677876e9b592858e","https://github.com/MariaDB/server/commit/f277eefa424850a8cba5c2371406047f6395e8bb","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-65jj-h265-3m7h","https://jira.mariadb.org/browse/MDEV-40362"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-92262","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the #mysql50# bypass prefix is affected because it allows the #mysql50# prefix to bypass normal table-name filesystem encoding. An attacker can trigger the issue with a table name using the #mysql50# prefix, then use a #mysql50# table name to access files under their legacy unencoded name and cause crashes, data corruption, data exfiltration, or remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107815","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107815","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"risk":0.6905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107815"},"relatedVulnerabilities":[{"id":"CVE-2026-107815","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.5,"impactScore":6.1,"exploitabilityScore":1.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107815","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107815","date":"2026-10-25","epss":0.01381,"percentile":0.71946}],"urls":["https://github.com/MariaDB/server/commit/b369925f6855d3e1f0ebcf453492724b99fda6f8","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-4wgx-ffg9-jrwq","https://jira.mariadb.org/browse/MDEV-40637"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107815","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine's DOS table type used an incorrect boundary check that permitted a one-byte null write beyond a stack buffer at an attacker-controlled offset. An authenticated user able to use the CONNECT engine could cause a crash and potentially remote code execution. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4981","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4981","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-25","epss":0.00875,"percentile":0.58698}],"risk":0.6562500000000001,"urls":["https://go.dev/cl/767860","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78803","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."},"relatedVulnerabilities":[{"id":"CVE-2026-33811","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33811","cwe":"CWE-415","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33811","cwe":"CWE-1341","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33811","date":"2026-10-25","epss":0.00875,"percentile":0.58698}],"urls":["https://go.dev/cl/767860","https://go.dev/issue/78803","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4981","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:35993","https://access.redhat.com/errata/RHSA-2026:35994","https://access.redhat.com/errata/RHSA-2026:35995","https://access.redhat.com/errata/RHSA-2026:36207","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36617","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36776","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38504","https://access.redhat.com/errata/RHSA-2026:39266","https://access.redhat.com/errata/RHSA-2026:39272","https://access.redhat.com/errata/RHSA-2026:39319","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41055","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42048","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42078","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42132","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42852","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46885","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48151","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:51194","https://access.redhat.com/errata/RHSA-2026:51341","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54556","https://access.redhat.com/errata/RHSA-2026:54584","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56790","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60302","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61313","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:67149","https://access.redhat.com/errata/RHSA-2026:67287","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/security/cve/CVE-2026-33811","https://bugzilla.redhat.com/show_bug.cgi?id=2467822","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33811.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33811","description":"When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4918","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4918","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-25","epss":0.0084,"percentile":0.57598}],"risk":0.63,"urls":["https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/761581","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."},"relatedVulnerabilities":[{"id":"CVE-2026-33814","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33814","cwe":"CWE-835","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-33814","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33814","date":"2026-10-25","epss":0.0084,"percentile":0.57598}],"urls":["https://go.dev/cl/761581","https://go.dev/cl/761640","https://go.dev/issue/78476","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4918","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:34342","https://access.redhat.com/errata/RHSA-2026:37387","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57191","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57365","https://access.redhat.com/errata/RHSA-2026:57367","https://access.redhat.com/errata/RHSA-2026:57408","https://access.redhat.com/errata/RHSA-2026:57545","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60441","https://access.redhat.com/errata/RHSA-2026:60442","https://access.redhat.com/errata/RHSA-2026:60446","https://access.redhat.com/errata/RHSA-2026:60447","https://access.redhat.com/errata/RHSA-2026:60454","https://access.redhat.com/errata/RHSA-2026:60477","https://access.redhat.com/errata/RHSA-2026:60478","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:60668","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62410","https://access.redhat.com/errata/RHSA-2026:62550","https://access.redhat.com/errata/RHSA-2026:62551","https://access.redhat.com/errata/RHSA-2026:63046","https://access.redhat.com/errata/RHSA-2026:63047","https://access.redhat.com/errata/RHSA-2026:63048","https://access.redhat.com/errata/RHSA-2026:63050","https://access.redhat.com/errata/RHSA-2026:63091","https://access.redhat.com/errata/RHSA-2026:63096","https://access.redhat.com/errata/RHSA-2026:63097","https://access.redhat.com/errata/RHSA-2026:63103","https://access.redhat.com/errata/RHSA-2026:63104","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:63637","https://access.redhat.com/errata/RHSA-2026:63639","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:66350","https://access.redhat.com/security/cve/CVE-2026-33814","https://bugzilla.redhat.com/show_bug.cgi?id=2467815","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33814.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33814","description":"When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107821","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107821","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"risk":0.601,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107821"},"relatedVulnerabilities":[{"id":"CVE-2026-107821","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":8,"impactScore":6.1,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107821","cwe":"CWE-1285","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107821","date":"2026-10-25","epss":0.01202,"percentile":0.68012}],"urls":["https://github.com/MariaDB/server/commit/3b1c2e58abab5571bec4ff52773ddc75b1738da9","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-c4gx-34mg-95q5","https://jira.mariadb.org/browse/MDEV-40571"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107821","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB insufficiently validated counts, offsets, lengths, and field boundaries in FRM metadata while opening binary FRM files. An attacker able to place a crafted FRM file in the data directory could trigger out-of-bounds reads or writes, crash the server, or potentially execute code. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4977","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4977","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-25","epss":0.00798,"percentile":0.56236}],"risk":0.5984999999999999,"urls":["https://go.dev/cl/771520","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78987","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."},"relatedVulnerabilities":[{"id":"CVE-2026-42499","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42499","cwe":"CWE-1046","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42499","date":"2026-10-25","epss":0.00798,"percentile":0.56236}],"urls":["https://go.dev/cl/771520","https://go.dev/issue/78987","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4977","https://access.redhat.com/errata/RHSA-2026:17713","https://access.redhat.com/errata/RHSA-2026:17714","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:63163","https://access.redhat.com/errata/RHSA-2026:63332","https://access.redhat.com/errata/RHSA-2026:63636","https://access.redhat.com/errata/RHSA-2026:64818","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67148","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-42499","https://bugzilla.redhat.com/show_bug.cgi?id=2467809","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42499.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42499","description":"Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4986","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4986","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-25","epss":0.00784,"percentile":0.55763}],"risk":0.588,"urls":["https://go.dev/cl/759940","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78566","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-39820","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39820","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-39820","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-39820","date":"2026-10-25","epss":0.00784,"percentile":0.55763}],"urls":["https://go.dev/cl/759940","https://go.dev/issue/78566","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4986","https://access.redhat.com/errata/RHSA-2026:22112","https://access.redhat.com/errata/RHSA-2026:22120","https://access.redhat.com/errata/RHSA-2026:22121","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:33120","https://access.redhat.com/errata/RHSA-2026:33123","https://access.redhat.com/errata/RHSA-2026:33142","https://access.redhat.com/errata/RHSA-2026:33150","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34364","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36754","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:40262","https://access.redhat.com/errata/RHSA-2026:41031","https://access.redhat.com/errata/RHSA-2026:41066","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42146","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42796","https://access.redhat.com/errata/RHSA-2026:43038","https://access.redhat.com/errata/RHSA-2026:43052","https://access.redhat.com/errata/RHSA-2026:43692","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50300","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:50336","https://access.redhat.com/errata/RHSA-2026:50843","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51112","https://access.redhat.com/errata/RHSA-2026:54274","https://access.redhat.com/errata/RHSA-2026:54283","https://access.redhat.com/errata/RHSA-2026:54284","https://access.redhat.com/errata/RHSA-2026:54285","https://access.redhat.com/errata/RHSA-2026:54286","https://access.redhat.com/errata/RHSA-2026:54287","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54552","https://access.redhat.com/errata/RHSA-2026:54555","https://access.redhat.com/errata/RHSA-2026:54583","https://access.redhat.com/errata/RHSA-2026:54602","https://access.redhat.com/errata/RHSA-2026:54883","https://access.redhat.com/errata/RHSA-2026:56340","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56854","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57401","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57487","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:57845","https://access.redhat.com/errata/RHSA-2026:57914","https://access.redhat.com/errata/RHSA-2026:59467","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60023","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:62260","https://access.redhat.com/errata/RHSA-2026:62406","https://access.redhat.com/errata/RHSA-2026:62407","https://access.redhat.com/errata/RHSA-2026:62753","https://access.redhat.com/errata/RHSA-2026:62754","https://access.redhat.com/errata/RHSA-2026:62803","https://access.redhat.com/errata/RHSA-2026:63022","https://access.redhat.com/errata/RHSA-2026:65116","https://access.redhat.com/errata/RHSA-2026:65117","https://access.redhat.com/errata/RHSA-2026:65153","https://access.redhat.com/errata/RHSA-2026:65335","https://access.redhat.com/errata/RHSA-2026:65336","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:65895","https://access.redhat.com/errata/RHSA-2026:66016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66327","https://access.redhat.com/errata/RHSA-2026:67517","https://access.redhat.com/errata/RHSA-2026:67974","https://access.redhat.com/errata/RHSA-2026:67975","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:68527","https://access.redhat.com/security/cve/CVE-2026-39820","https://bugzilla.redhat.com/show_bug.cgi?id=2467820","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-39820.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39820","description":"Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4601","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4601","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-25","epss":0.00774,"percentile":0.55455}],"risk":0.5805,"urls":["https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/752180","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."},"relatedVulnerabilities":[{"id":"CVE-2026-25679","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-25679","cwe":"CWE-425","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-25679","cwe":"CWE-1286","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-25679","date":"2026-10-25","epss":0.00774,"percentile":0.55455}],"urls":["https://go.dev/cl/752180","https://go.dev/issue/77578","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4601","https://access.redhat.com/errata/RHSA-2026:10065","https://access.redhat.com/errata/RHSA-2026:10125","https://access.redhat.com/errata/RHSA-2026:10133","https://access.redhat.com/errata/RHSA-2026:10140","https://access.redhat.com/errata/RHSA-2026:10141","https://access.redhat.com/errata/RHSA-2026:10158","https://access.redhat.com/errata/RHSA-2026:10169","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/errata/RHSA-2026:10184","https://access.redhat.com/errata/RHSA-2026:10225","https://access.redhat.com/errata/RHSA-2026:10250","https://access.redhat.com/errata/RHSA-2026:10701","https://access.redhat.com/errata/RHSA-2026:10712","https://access.redhat.com/errata/RHSA-2026:10929","https://access.redhat.com/errata/RHSA-2026:11217","https://access.redhat.com/errata/RHSA-2026:11375","https://access.redhat.com/errata/RHSA-2026:11412","https://access.redhat.com/errata/RHSA-2026:11413","https://access.redhat.com/errata/RHSA-2026:11686","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:11747","https://access.redhat.com/errata/RHSA-2026:11749","https://access.redhat.com/errata/RHSA-2026:11768","https://access.redhat.com/errata/RHSA-2026:11800","https://access.redhat.com/errata/RHSA-2026:11856","https://access.redhat.com/errata/RHSA-2026:11916","https://access.redhat.com/errata/RHSA-2026:11996","https://access.redhat.com/errata/RHSA-2026:12028","https://access.redhat.com/errata/RHSA-2026:12029","https://access.redhat.com/errata/RHSA-2026:12030","https://access.redhat.com/errata/RHSA-2026:12031","https://access.redhat.com/errata/RHSA-2026:12032","https://access.redhat.com/errata/RHSA-2026:12033","https://access.redhat.com/errata/RHSA-2026:12282","https://access.redhat.com/errata/RHSA-2026:13508","https://access.redhat.com/errata/RHSA-2026:13512","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13642","https://access.redhat.com/errata/RHSA-2026:13643","https://access.redhat.com/errata/RHSA-2026:13671","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14100","https://access.redhat.com/errata/RHSA-2026:14774","https://access.redhat.com/errata/RHSA-2026:14868","https://access.redhat.com/errata/RHSA-2026:14879","https://access.redhat.com/errata/RHSA-2026:15091","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16696","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17040","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:17598","https://access.redhat.com/errata/RHSA-2026:19017","https://access.redhat.com/errata/RHSA-2026:19022","https://access.redhat.com/errata/RHSA-2026:19026","https://access.redhat.com/errata/RHSA-2026:19027","https://access.redhat.com/errata/RHSA-2026:19031","https://access.redhat.com/errata/RHSA-2026:19032","https://access.redhat.com/errata/RHSA-2026:19049","https://access.redhat.com/errata/RHSA-2026:19055","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19128","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19181","https://access.redhat.com/errata/RHSA-2026:19184","https://access.redhat.com/errata/RHSA-2026:19185","https://access.redhat.com/errata/RHSA-2026:19207","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19475","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:20041","https://access.redhat.com/errata/RHSA-2026:20088","https://access.redhat.com/errata/RHSA-2026:20581","https://access.redhat.com/errata/RHSA-2026:20582","https://access.redhat.com/errata/RHSA-2026:20584","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21657","https://access.redhat.com/errata/RHSA-2026:21691","https://access.redhat.com/errata/RHSA-2026:21696","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22627","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22733","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24386","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:25043","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26445","https://access.redhat.com/errata/RHSA-2026:26527","https://access.redhat.com/errata/RHSA-2026:26541","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28893","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:5110","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:52389","https://access.redhat.com/errata/RHSA-2026:52390","https://access.redhat.com/errata/RHSA-2026:52391","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:5549","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:5941","https://access.redhat.com/errata/RHSA-2026:5942","https://access.redhat.com/errata/RHSA-2026:5943","https://access.redhat.com/errata/RHSA-2026:5944","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:6341","https://access.redhat.com/errata/RHSA-2026:6344","https://access.redhat.com/errata/RHSA-2026:6382","https://access.redhat.com/errata/RHSA-2026:6383","https://access.redhat.com/errata/RHSA-2026:6388","https://access.redhat.com/errata/RHSA-2026:6564","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:6720","https://access.redhat.com/errata/RHSA-2026:6802","https://access.redhat.com/errata/RHSA-2026:6949","https://access.redhat.com/errata/RHSA-2026:7005","https://access.redhat.com/errata/RHSA-2026:7009","https://access.redhat.com/errata/RHSA-2026:7011","https://access.redhat.com/errata/RHSA-2026:7259","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7315","https://access.redhat.com/errata/RHSA-2026:7328","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/errata/RHSA-2026:7665","https://access.redhat.com/errata/RHSA-2026:7669","https://access.redhat.com/errata/RHSA-2026:7674","https://access.redhat.com/errata/RHSA-2026:7833","https://access.redhat.com/errata/RHSA-2026:7834","https://access.redhat.com/errata/RHSA-2026:7876","https://access.redhat.com/errata/RHSA-2026:7877","https://access.redhat.com/errata/RHSA-2026:7878","https://access.redhat.com/errata/RHSA-2026:7879","https://access.redhat.com/errata/RHSA-2026:7883","https://access.redhat.com/errata/RHSA-2026:7992","https://access.redhat.com/errata/RHSA-2026:8151","https://access.redhat.com/errata/RHSA-2026:8167","https://access.redhat.com/errata/RHSA-2026:8314","https://access.redhat.com/errata/RHSA-2026:8322","https://access.redhat.com/errata/RHSA-2026:8324","https://access.redhat.com/errata/RHSA-2026:8337","https://access.redhat.com/errata/RHSA-2026:8338","https://access.redhat.com/errata/RHSA-2026:8433","https://access.redhat.com/errata/RHSA-2026:8434","https://access.redhat.com/errata/RHSA-2026:8456","https://access.redhat.com/errata/RHSA-2026:8483","https://access.redhat.com/errata/RHSA-2026:8484","https://access.redhat.com/errata/RHSA-2026:8490","https://access.redhat.com/errata/RHSA-2026:8491","https://access.redhat.com/errata/RHSA-2026:8493","https://access.redhat.com/errata/RHSA-2026:8840","https://access.redhat.com/errata/RHSA-2026:8841","https://access.redhat.com/errata/RHSA-2026:8842","https://access.redhat.com/errata/RHSA-2026:8845","https://access.redhat.com/errata/RHSA-2026:8847","https://access.redhat.com/errata/RHSA-2026:8848","https://access.redhat.com/errata/RHSA-2026:8849","https://access.redhat.com/errata/RHSA-2026:8851","https://access.redhat.com/errata/RHSA-2026:8852","https://access.redhat.com/errata/RHSA-2026:8853","https://access.redhat.com/errata/RHSA-2026:8855","https://access.redhat.com/errata/RHSA-2026:8856","https://access.redhat.com/errata/RHSA-2026:8860","https://access.redhat.com/errata/RHSA-2026:8877","https://access.redhat.com/errata/RHSA-2026:8878","https://access.redhat.com/errata/RHSA-2026:8879","https://access.redhat.com/errata/RHSA-2026:8881","https://access.redhat.com/errata/RHSA-2026:8882","https://access.redhat.com/errata/RHSA-2026:8930","https://access.redhat.com/errata/RHSA-2026:8931","https://access.redhat.com/errata/RHSA-2026:8949","https://access.redhat.com/errata/RHSA-2026:9043","https://access.redhat.com/errata/RHSA-2026:9044","https://access.redhat.com/errata/RHSA-2026:9052","https://access.redhat.com/errata/RHSA-2026:9090","https://access.redhat.com/errata/RHSA-2026:9093","https://access.redhat.com/errata/RHSA-2026:9094","https://access.redhat.com/errata/RHSA-2026:9097","https://access.redhat.com/errata/RHSA-2026:9098","https://access.redhat.com/errata/RHSA-2026:9108","https://access.redhat.com/errata/RHSA-2026:9109","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/errata/RHSA-2026:9434","https://access.redhat.com/errata/RHSA-2026:9435","https://access.redhat.com/errata/RHSA-2026:9436","https://access.redhat.com/errata/RHSA-2026:9439","https://access.redhat.com/errata/RHSA-2026:9440","https://access.redhat.com/errata/RHSA-2026:9448","https://access.redhat.com/errata/RHSA-2026:9453","https://access.redhat.com/errata/RHSA-2026:9461","https://access.redhat.com/errata/RHSA-2026:9695","https://access.redhat.com/errata/RHSA-2026:9742","https://access.redhat.com/errata/RHSA-2026:9872","https://access.redhat.com/security/cve/CVE-2026-25679","https://bugzilla.redhat.com/show_bug.cgi?id=2445356","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-25679.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-25679","description":"url.Parse insufficiently validated the host/authority component and accepted some invalid URLs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6612","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6612","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-25","epss":0.00622,"percentile":0.49496}],"risk":0.56291,"urls":["https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847187","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."},"relatedVulnerabilities":[{"id":"CVE-2026-78663","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78663","cwe":"CWE-675","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78663","date":"2026-10-25","epss":0.00622,"percentile":0.49496}],"urls":["https://go.dev/cl/847187","https://go.dev/cl/847310","https://go.dev/issue/81743","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6612"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78663","description":"The HTTP/2 server can refund connection-level flow control twice for the same data: Once when a client resets a stream (refunding data for any sent-but-unread portion of the stream), and again when a request handler reads the buffered data. A malicious client can exploit this to bypass the configured connection-level flow control limit (MaxReceiveBufferPerConnection). Total buffered data is still limited by the concurrent stream limit and stream-level flow control."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6604","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6604","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-25","epss":0.00553,"percentile":0.45941}],"risk":0.5198200000000001,"urls":["https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Critical","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847305","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."},"relatedVulnerabilities":[{"id":"CVE-2026-56857","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56857","cwe":"CWE-1386","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56857","date":"2026-10-25","epss":0.00553,"percentile":0.45941}],"urls":["https://go.dev/cl/847305","https://go.dev/issue/81739","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6604"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56857","description":"On Windows, when the target of Root.Mkdir or Root.MkdirAll is a junction pointing to an empty location, the operation can create a directory at the junction target even when that target is located outside the root. This only applies to operations where the last path component is a junction (path/to/junction, but not path/junction/target)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4009","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4009","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-25","epss":0.00661,"percentile":0.51351}],"risk":0.49575,"urls":["https://go.dev/cl/709858","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75676","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.\n\nThis affects programs which parse untrusted PEM inputs."},"relatedVulnerabilities":[{"id":"CVE-2025-61723","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61723","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61723","date":"2026-10-25","epss":0.00661,"percentile":0.51351}],"urls":["https://go.dev/cl/709858","https://go.dev/issue/75676","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4009","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61723","description":"The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4006","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4006","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-25","epss":0.00647,"percentile":0.50735}],"risk":0.48525,"urls":["https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709860","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61725","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61725","date":"2026-10-25","epss":0.00647,"percentile":0.50735}],"urls":["https://go.dev/cl/709860","https://go.dev/issue/75680","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4006","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61725","description":"The ParseAddress function constructs domain-literal address components through repeated string concatenation. When parsing large domain-literal components, this can cause excessive CPU consumption."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85746","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85746","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"risk":0.485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85746"},"relatedVulnerabilities":[{"id":"CVE-2026-85746","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85746","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85746","date":"2026-10-25","epss":0.0097,"percentile":0.61651}],"urls":["https://github.com/MariaDB/server/commit/5c04ca5524385356ff7cf84974a7d491974c1f85","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-8fvj-c57c-pggx","https://jira.mariadb.org/browse/MDEV-40329"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85746","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_AsText can write beyond an allocated output buffer when converting deeply nested GeometryCollections because recursive WKT serialization does not account for bytes consumed or reserve sufficient space. A low-privileged remote attacker can submit a specially crafted GIS object to corrupt memory and potentially achieve code execution when combined with another vulnerability. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4971","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4971","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-25","epss":0.00633,"percentile":0.50028}],"risk":0.47475,"urls":["https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://go.dev/cl/775320"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79006","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."},"relatedVulnerabilities":[{"id":"CVE-2026-39836","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39836","cwe":"CWE-476","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39836","date":"2026-10-25","epss":0.00633,"percentile":0.50028}],"urls":["https://go.dev/cl/775320","https://go.dev/issue/79006","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4971"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39836","description":"The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6603","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6603","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-25","epss":0.00627,"percentile":0.4977}],"risk":0.47025,"urls":["https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847185","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."},"relatedVulnerabilities":[{"id":"CVE-2026-78659","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78659","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78659","date":"2026-10-25","epss":0.00627,"percentile":0.4977}],"urls":["https://go.dev/cl/847185","https://go.dev/cl/847314","https://go.dev/issue/81857","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6603"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78659","description":"When \"Trailer\" headers are sent by a client, the HTTP server internally uses the header values to populate the Request.Trailer map passed to the server handler. Because Request.Trailer is a map, each entry incurs memory overhead. For HTTP/2 servers, a malicious client can exploit this by sending a \"Trailer\" header that declares a large number of fields, causing the server to allocate a disproportionate amount of memory while bypassing Server.MaxHeaderValueCount and Server.MaxHeaderBytes limits. This exploit is not applicable for HTTP/1 servers, which do not support multiplexing a large number of requests over one TCP connection, and whose Server.MaxHeaderBytes are calculated differently."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4870","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4870","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-25","epss":0.00621,"percentile":0.49483}],"risk":0.46575,"urls":["https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763767","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service.\n\nThis only affects TLS 1.3."},"relatedVulnerabilities":[{"id":"CVE-2026-32283","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32283","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2026-32283","cwe":"CWE-764","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32283","date":"2026-10-25","epss":0.00621,"percentile":0.49483}],"urls":["https://go.dev/cl/763767","https://go.dev/issue/78334","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4870","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11704","https://access.redhat.com/errata/RHSA-2026:11711","https://access.redhat.com/errata/RHSA-2026:11712","https://access.redhat.com/errata/RHSA-2026:11863","https://access.redhat.com/errata/RHSA-2026:11881","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16102","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17075","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19126","https://access.redhat.com/errata/RHSA-2026:19132","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19134","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19136","https://access.redhat.com/errata/RHSA-2026:19137","https://access.redhat.com/errata/RHSA-2026:19139","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19156","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19351","https://access.redhat.com/errata/RHSA-2026:19352","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19369","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22423","https://access.redhat.com/errata/RHSA-2026:22450","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22714","https://access.redhat.com/errata/RHSA-2026:22937","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23228","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55898","https://access.redhat.com/errata/RHSA-2026:55900","https://access.redhat.com/errata/RHSA-2026:55901","https://access.redhat.com/errata/RHSA-2026:55902","https://access.redhat.com/errata/RHSA-2026:55903","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57801","https://access.redhat.com/errata/RHSA-2026:57802","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:65126","https://access.redhat.com/errata/RHSA-2026:65343","https://access.redhat.com/errata/RHSA-2026:65514","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:66084","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:66523","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:7291","https://access.redhat.com/errata/RHSA-2026:7385","https://access.redhat.com/security/cve/CVE-2026-32283","https://bugzilla.redhat.com/show_bug.cgi?id=2456338","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32283.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32283","description":"If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85748","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"risk":0.462,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85748"},"relatedVulnerabilities":[{"id":"CVE-2026-85748","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":9.9,"impactScore":6.1,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85748","cwe":"CWE-416","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85748","date":"2026-10-25","epss":0.00924,"percentile":0.60174}],"urls":["https://github.com/MariaDB/server/commit/91156c3de58762196605150ab3f756fe952592d1","https://github.com/MariaDB/server/commit/9b075b2cb53338f67e7230cc585e02d2d34514ed","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mv8g-9f7q-hprm","https://jira.mariadb.org/browse/MDEV-40396","https://jira.mariadb.org/browse/MDEV-40639"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85748","description":"MariaDB server is a community developed fork of MySQL server. From 12.3.1 until 12.3.3 and 13.0.2, SYS_REFCURSOR handling is affected because cursor-array reallocation can leave stale references in routine contexts. A low-privileged attacker can open a large number of SYS_REFCURSORs and then fetch one to trigger a use-after-free that can enable remote code execution when combined with another vulnerability. This issue is fixed in versions 12.3.3 and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4947","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4947","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-25","epss":0.00615,"percentile":0.49143}],"risk":0.46125000000000005,"urls":["https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758320","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."},"relatedVulnerabilities":[{"id":"CVE-2026-32280","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-32280","cwe":"CWE-770","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-32280","date":"2026-10-25","epss":0.00615,"percentile":0.49143}],"urls":["https://go.dev/cl/758320","https://go.dev/issue/78282","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4947","https://access.redhat.com/errata/RHSA-2026:10217","https://access.redhat.com/errata/RHSA-2026:10219","https://access.redhat.com/errata/RHSA-2026:10704","https://access.redhat.com/errata/RHSA-2026:11507","https://access.redhat.com/errata/RHSA-2026:11514","https://access.redhat.com/errata/RHSA-2026:11688","https://access.redhat.com/errata/RHSA-2026:13545","https://access.redhat.com/errata/RHSA-2026:13791","https://access.redhat.com/errata/RHSA-2026:13826","https://access.redhat.com/errata/RHSA-2026:13829","https://access.redhat.com/errata/RHSA-2026:14020","https://access.redhat.com/errata/RHSA-2026:14162","https://access.redhat.com/errata/RHSA-2026:14200","https://access.redhat.com/errata/RHSA-2026:14391","https://access.redhat.com/errata/RHSA-2026:15980","https://access.redhat.com/errata/RHSA-2026:16021","https://access.redhat.com/errata/RHSA-2026:16024","https://access.redhat.com/errata/RHSA-2026:16101","https://access.redhat.com/errata/RHSA-2026:16476","https://access.redhat.com/errata/RHSA-2026:16477","https://access.redhat.com/errata/RHSA-2026:16505","https://access.redhat.com/errata/RHSA-2026:16508","https://access.redhat.com/errata/RHSA-2026:16532","https://access.redhat.com/errata/RHSA-2026:16534","https://access.redhat.com/errata/RHSA-2026:16535","https://access.redhat.com/errata/RHSA-2026:16537","https://access.redhat.com/errata/RHSA-2026:16542","https://access.redhat.com/errata/RHSA-2026:16874","https://access.redhat.com/errata/RHSA-2026:16875","https://access.redhat.com/errata/RHSA-2026:17084","https://access.redhat.com/errata/RHSA-2026:17287","https://access.redhat.com/errata/RHSA-2026:18027","https://access.redhat.com/errata/RHSA-2026:18032","https://access.redhat.com/errata/RHSA-2026:19133","https://access.redhat.com/errata/RHSA-2026:19135","https://access.redhat.com/errata/RHSA-2026:19144","https://access.redhat.com/errata/RHSA-2026:19350","https://access.redhat.com/errata/RHSA-2026:19353","https://access.redhat.com/errata/RHSA-2026:19375","https://access.redhat.com/errata/RHSA-2026:19450","https://access.redhat.com/errata/RHSA-2026:19550","https://access.redhat.com/errata/RHSA-2026:19634","https://access.redhat.com/errata/RHSA-2026:19714","https://access.redhat.com/errata/RHSA-2026:19715","https://access.redhat.com/errata/RHSA-2026:19719","https://access.redhat.com/errata/RHSA-2026:19720","https://access.redhat.com/errata/RHSA-2026:19721","https://access.redhat.com/errata/RHSA-2026:19722","https://access.redhat.com/errata/RHSA-2026:19750","https://access.redhat.com/errata/RHSA-2026:19839","https://access.redhat.com/errata/RHSA-2026:20556","https://access.redhat.com/errata/RHSA-2026:20569","https://access.redhat.com/errata/RHSA-2026:20570","https://access.redhat.com/errata/RHSA-2026:20571","https://access.redhat.com/errata/RHSA-2026:20607","https://access.redhat.com/errata/RHSA-2026:20608","https://access.redhat.com/errata/RHSA-2026:20609","https://access.redhat.com/errata/RHSA-2026:20889","https://access.redhat.com/errata/RHSA-2026:21017","https://access.redhat.com/errata/RHSA-2026:21338","https://access.redhat.com/errata/RHSA-2026:21655","https://access.redhat.com/errata/RHSA-2026:21769","https://access.redhat.com/errata/RHSA-2026:21772","https://access.redhat.com/errata/RHSA-2026:22130","https://access.redhat.com/errata/RHSA-2026:22141","https://access.redhat.com/errata/RHSA-2026:22258","https://access.redhat.com/errata/RHSA-2026:22260","https://access.redhat.com/errata/RHSA-2026:22268","https://access.redhat.com/errata/RHSA-2026:22309","https://access.redhat.com/errata/RHSA-2026:22347","https://access.redhat.com/errata/RHSA-2026:22415","https://access.redhat.com/errata/RHSA-2026:22422","https://access.redhat.com/errata/RHSA-2026:22465","https://access.redhat.com/errata/RHSA-2026:22485","https://access.redhat.com/errata/RHSA-2026:22709","https://access.redhat.com/errata/RHSA-2026:22713","https://access.redhat.com/errata/RHSA-2026:22840","https://access.redhat.com/errata/RHSA-2026:22862","https://access.redhat.com/errata/RHSA-2026:22958","https://access.redhat.com/errata/RHSA-2026:22959","https://access.redhat.com/errata/RHSA-2026:22960","https://access.redhat.com/errata/RHSA-2026:22961","https://access.redhat.com/errata/RHSA-2026:22962","https://access.redhat.com/errata/RHSA-2026:23102","https://access.redhat.com/errata/RHSA-2026:23103","https://access.redhat.com/errata/RHSA-2026:23244","https://access.redhat.com/errata/RHSA-2026:23345","https://access.redhat.com/errata/RHSA-2026:23361","https://access.redhat.com/errata/RHSA-2026:24337","https://access.redhat.com/errata/RHSA-2026:24359","https://access.redhat.com/errata/RHSA-2026:24470","https://access.redhat.com/errata/RHSA-2026:24478","https://access.redhat.com/errata/RHSA-2026:24716","https://access.redhat.com/errata/RHSA-2026:24761","https://access.redhat.com/errata/RHSA-2026:24762","https://access.redhat.com/errata/RHSA-2026:24853","https://access.redhat.com/errata/RHSA-2026:24977","https://access.redhat.com/errata/RHSA-2026:25089","https://access.redhat.com/errata/RHSA-2026:25127","https://access.redhat.com/errata/RHSA-2026:25180","https://access.redhat.com/errata/RHSA-2026:25248","https://access.redhat.com/errata/RHSA-2026:25250","https://access.redhat.com/errata/RHSA-2026:25251","https://access.redhat.com/errata/RHSA-2026:25252","https://access.redhat.com/errata/RHSA-2026:25253","https://access.redhat.com/errata/RHSA-2026:26447","https://access.redhat.com/errata/RHSA-2026:26568","https://access.redhat.com/errata/RHSA-2026:26571","https://access.redhat.com/errata/RHSA-2026:26585","https://access.redhat.com/errata/RHSA-2026:26636","https://access.redhat.com/errata/RHSA-2026:27076","https://access.redhat.com/errata/RHSA-2026:28038","https://access.redhat.com/errata/RHSA-2026:28047","https://access.redhat.com/errata/RHSA-2026:28074","https://access.redhat.com/errata/RHSA-2026:28196","https://access.redhat.com/errata/RHSA-2026:28198","https://access.redhat.com/errata/RHSA-2026:28441","https://access.redhat.com/errata/RHSA-2026:28886","https://access.redhat.com/errata/RHSA-2026:28961","https://access.redhat.com/errata/RHSA-2026:29035","https://access.redhat.com/errata/RHSA-2026:29195","https://access.redhat.com/errata/RHSA-2026:29455","https://access.redhat.com/errata/RHSA-2026:29702","https://access.redhat.com/errata/RHSA-2026:29703","https://access.redhat.com/errata/RHSA-2026:29854","https://access.redhat.com/errata/RHSA-2026:33722","https://access.redhat.com/errata/RHSA-2026:34097","https://access.redhat.com/errata/RHSA-2026:34192","https://access.redhat.com/errata/RHSA-2026:34196","https://access.redhat.com/errata/RHSA-2026:34197","https://access.redhat.com/errata/RHSA-2026:34365","https://access.redhat.com/errata/RHSA-2026:36319","https://access.redhat.com/errata/RHSA-2026:36625","https://access.redhat.com/errata/RHSA-2026:36651","https://access.redhat.com/errata/RHSA-2026:36796","https://access.redhat.com/errata/RHSA-2026:39810","https://access.redhat.com/errata/RHSA-2026:39894","https://access.redhat.com/errata/RHSA-2026:40118","https://access.redhat.com/errata/RHSA-2026:40945","https://access.redhat.com/errata/RHSA-2026:41019","https://access.redhat.com/errata/RHSA-2026:41928","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:47712","https://access.redhat.com/errata/RHSA-2026:47714","https://access.redhat.com/errata/RHSA-2026:47716","https://access.redhat.com/errata/RHSA-2026:47719","https://access.redhat.com/errata/RHSA-2026:47721","https://access.redhat.com/errata/RHSA-2026:47722","https://access.redhat.com/errata/RHSA-2026:47910","https://access.redhat.com/errata/RHSA-2026:47952","https://access.redhat.com/errata/RHSA-2026:48036","https://access.redhat.com/errata/RHSA-2026:48790","https://access.redhat.com/errata/RHSA-2026:49509","https://access.redhat.com/errata/RHSA-2026:49526","https://access.redhat.com/errata/RHSA-2026:49600","https://access.redhat.com/errata/RHSA-2026:49838","https://access.redhat.com/errata/RHSA-2026:49944","https://access.redhat.com/errata/RHSA-2026:51033","https://access.redhat.com/errata/RHSA-2026:51288","https://access.redhat.com/errata/RHSA-2026:54191","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:56785","https://access.redhat.com/errata/RHSA-2026:56789","https://access.redhat.com/errata/RHSA-2026:56852","https://access.redhat.com/errata/RHSA-2026:56855","https://access.redhat.com/errata/RHSA-2026:56910","https://access.redhat.com/errata/RHSA-2026:56912","https://access.redhat.com/errata/RHSA-2026:56913","https://access.redhat.com/errata/RHSA-2026:57409","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:59830","https://access.redhat.com/errata/RHSA-2026:59833","https://access.redhat.com/errata/RHSA-2026:59834","https://access.redhat.com/errata/RHSA-2026:60018","https://access.redhat.com/errata/RHSA-2026:60520","https://access.redhat.com/errata/RHSA-2026:61685","https://access.redhat.com/errata/RHSA-2026:61906","https://access.redhat.com/errata/RHSA-2026:61907","https://access.redhat.com/errata/RHSA-2026:65534","https://access.redhat.com/errata/RHSA-2026:65838","https://access.redhat.com/errata/RHSA-2026:65886","https://access.redhat.com/errata/RHSA-2026:66401","https://access.redhat.com/errata/RHSA-2026:67319","https://access.redhat.com/errata/RHSA-2026:68504","https://access.redhat.com/errata/RHSA-2026:9385","https://access.redhat.com/security/cve/CVE-2026-32280","https://bugzilla.redhat.com/show_bug.cgi?id=2456339","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-32280.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32280","description":"During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6611","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6611","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-25","epss":0.00614,"percentile":0.49111}],"risk":0.46049999999999996,"urls":["https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847186","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."},"relatedVulnerabilities":[{"id":"CVE-2026-78669","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78669","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78669","date":"2026-10-25","epss":0.00614,"percentile":0.49111}],"urls":["https://go.dev/cl/847186","https://go.dev/cl/847308","https://go.dev/issue/81742","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6611"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78669","description":"A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5037","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5037","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-25","epss":0.00591,"percentile":0.47958}],"risk":0.4432500000000001,"urls":["https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/783621","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname.\n\nWith a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."},"relatedVulnerabilities":[{"id":"CVE-2026-27145","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27145","cwe":"CWE-606","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-27145","date":"2026-10-25","epss":0.00591,"percentile":0.47958}],"urls":["https://go.dev/cl/783621","https://go.dev/issue/79694","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5037","https://access.redhat.com/errata/RHSA-2026:23262","https://access.redhat.com/errata/RHSA-2026:23264","https://access.redhat.com/errata/RHSA-2026:29980","https://access.redhat.com/errata/RHSA-2026:29981","https://access.redhat.com/errata/RHSA-2026:33574","https://access.redhat.com/errata/RHSA-2026:34357","https://access.redhat.com/errata/RHSA-2026:34359","https://access.redhat.com/errata/RHSA-2026:35832","https://access.redhat.com/errata/RHSA-2026:36317","https://access.redhat.com/errata/RHSA-2026:36648","https://access.redhat.com/errata/RHSA-2026:36797","https://access.redhat.com/errata/RHSA-2026:38995","https://access.redhat.com/errata/RHSA-2026:39005","https://access.redhat.com/errata/RHSA-2026:39573","https://access.redhat.com/errata/RHSA-2026:39879","https://access.redhat.com/errata/RHSA-2026:41030","https://access.redhat.com/errata/RHSA-2026:41036","https://access.redhat.com/errata/RHSA-2026:41930","https://access.redhat.com/errata/RHSA-2026:42043","https://access.redhat.com/errata/RHSA-2026:42047","https://access.redhat.com/errata/RHSA-2026:42049","https://access.redhat.com/errata/RHSA-2026:42050","https://access.redhat.com/errata/RHSA-2026:42051","https://access.redhat.com/errata/RHSA-2026:42079","https://access.redhat.com/errata/RHSA-2026:42080","https://access.redhat.com/errata/RHSA-2026:42082","https://access.redhat.com/errata/RHSA-2026:42142","https://access.redhat.com/errata/RHSA-2026:42150","https://access.redhat.com/errata/RHSA-2026:42151","https://access.redhat.com/errata/RHSA-2026:42240","https://access.redhat.com/errata/RHSA-2026:42644","https://access.redhat.com/errata/RHSA-2026:42946","https://access.redhat.com/errata/RHSA-2026:44622","https://access.redhat.com/errata/RHSA-2026:46394","https://access.redhat.com/errata/RHSA-2026:46395","https://access.redhat.com/errata/RHSA-2026:47149","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:49702","https://access.redhat.com/errata/RHSA-2026:49703","https://access.redhat.com/errata/RHSA-2026:49705","https://access.redhat.com/errata/RHSA-2026:49712","https://access.redhat.com/errata/RHSA-2026:49729","https://access.redhat.com/errata/RHSA-2026:49744","https://access.redhat.com/errata/RHSA-2026:49765","https://access.redhat.com/errata/RHSA-2026:49770","https://access.redhat.com/errata/RHSA-2026:50205","https://access.redhat.com/errata/RHSA-2026:50319","https://access.redhat.com/errata/RHSA-2026:51057","https://access.redhat.com/errata/RHSA-2026:51187","https://access.redhat.com/errata/RHSA-2026:52946","https://access.redhat.com/errata/RHSA-2026:53374","https://access.redhat.com/errata/RHSA-2026:53412","https://access.redhat.com/errata/RHSA-2026:53413","https://access.redhat.com/errata/RHSA-2026:53415","https://access.redhat.com/errata/RHSA-2026:53416","https://access.redhat.com/errata/RHSA-2026:53530","https://access.redhat.com/errata/RHSA-2026:54168","https://access.redhat.com/errata/RHSA-2026:54401","https://access.redhat.com/errata/RHSA-2026:54427","https://access.redhat.com/errata/RHSA-2026:54432","https://access.redhat.com/errata/RHSA-2026:54435","https://access.redhat.com/errata/RHSA-2026:54441","https://access.redhat.com/errata/RHSA-2026:54500","https://access.redhat.com/errata/RHSA-2026:54525","https://access.redhat.com/errata/RHSA-2026:54531","https://access.redhat.com/errata/RHSA-2026:54603","https://access.redhat.com/errata/RHSA-2026:54757","https://access.redhat.com/errata/RHSA-2026:55899","https://access.redhat.com/errata/RHSA-2026:57194","https://access.redhat.com/errata/RHSA-2026:57482","https://access.redhat.com/errata/RHSA-2026:57488","https://access.redhat.com/errata/RHSA-2026:57649","https://access.redhat.com/errata/RHSA-2026:59556","https://access.redhat.com/errata/RHSA-2026:59557","https://access.redhat.com/errata/RHSA-2026:59558","https://access.redhat.com/errata/RHSA-2026:59559","https://access.redhat.com/errata/RHSA-2026:59579","https://access.redhat.com/errata/RHSA-2026:59593","https://access.redhat.com/errata/RHSA-2026:60025","https://access.redhat.com/errata/RHSA-2026:60315","https://access.redhat.com/errata/RHSA-2026:60354","https://access.redhat.com/errata/RHSA-2026:60386","https://access.redhat.com/errata/RHSA-2026:60387","https://access.redhat.com/errata/RHSA-2026:60388","https://access.redhat.com/errata/RHSA-2026:60390","https://access.redhat.com/errata/RHSA-2026:60391","https://access.redhat.com/errata/RHSA-2026:61253","https://access.redhat.com/errata/RHSA-2026:61314","https://access.redhat.com/errata/RHSA-2026:63016","https://access.redhat.com/errata/RHSA-2026:66022","https://access.redhat.com/errata/RHSA-2026:68334","https://access.redhat.com/errata/RHSA-2026:68335","https://access.redhat.com/security/cve/CVE-2026-27145","https://bugzilla.redhat.com/show_bug.cgi?id=2484207","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-27145.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27145","description":"(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, \".\") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5972","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5972","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://go.dev/cl/814980"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80405","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."},"relatedVulnerabilities":[{"id":"CVE-2026-33818","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33818","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-33818","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/814980","https://go.dev/issue/80405","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-5972"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33818","description":"Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6089","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6089","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://go.dev/cl/795540","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80205","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."},"relatedVulnerabilities":[{"id":"CVE-2026-56853","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56853","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56853","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/795540","https://go.dev/issue/80205","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6089"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56853","description":"When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6090","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6090","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"risk":0.426,"urls":["https://go.dev/cl/804261","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80528","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."},"relatedVulnerabilities":[{"id":"CVE-2026-56862","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56862","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56862","date":"2026-10-25","epss":0.00568,"percentile":0.46789}],"urls":["https://go.dev/cl/804261","https://go.dev/issue/80528","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6090"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56862","description":"Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6088","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6088","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-25","epss":0.00568,"percentile":0.46788}],"risk":0.426,"urls":["https://go.dev/cl/803320","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80481","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2026-56859","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56859","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56859","date":"2026-10-25","epss":0.00568,"percentile":0.46788}],"urls":["https://go.dev/cl/803320","https://go.dev/issue/80481","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6088"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56859","description":"Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4342","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4342","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-25","epss":0.00738,"percentile":0.5425}],"risk":0.42435,"urls":["https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/736713","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."},"relatedVulnerabilities":[{"id":"CVE-2025-61728","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61728","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61728","date":"2026-10-25","epss":0.00738,"percentile":0.5425}],"urls":["https://go.dev/cl/736713","https://go.dev/issue/77102","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4342","http://www.openwall.com/lists/oss-security/2026/01/15/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61728","description":"archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5038","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5038","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-25","epss":0.0056,"percentile":0.4635}],"risk":0.42,"urls":["https://go.dev/cl/774481","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79217","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-42504","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42504","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42504","date":"2026-10-25","epss":0.0056,"percentile":0.4635}],"urls":["https://go.dev/cl/774481","https://go.dev/issue/79217","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5038"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42504","description":"Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107823","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107823","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"risk":0.393,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107823"},"relatedVulnerabilities":[{"id":"CVE-2026-107823","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107823","cwe":"CWE-116","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107823","cwe":"CWE-144","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107823","date":"2026-10-25","epss":0.00786,"percentile":0.55848}],"urls":["https://github.com/MariaDB/server/commit/8a642bc8103aadc6b2087d781ba8e1595616a2c4","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-g2q2-3936-cp37","https://jira.mariadb.org/browse/MDEV-40484"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107823","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the MariaDB view FRM parser did not safely encode embedded newline characters in a username. An account with CREATE USER and CREATE VIEW WITH GRANT OPTION could create a crafted username containing additional view metadata, causing the parser to interpret part of the username as security metadata and potentially escalating database privileges. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6607","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6607","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-25","epss":0.00519,"percentile":0.43798}],"risk":0.38925,"urls":["https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847312","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references.\n\nWe now reject these as malformed and curb the memory amplification vector as a result."},"relatedVulnerabilities":[{"id":"CVE-2026-97031","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97031","cwe":"CWE-405","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97031","date":"2026-10-25","epss":0.00519,"percentile":0.43798}],"urls":["https://go.dev/cl/847312","https://go.dev/issue/81855","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6607"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97031","description":"Multiple ECH outer extension references are not permitted under RFC 9849; previously, a client could send a well-crafted packet that could trigger memory exhaustion in the server process by specifying multiple references. We now reject these as malformed and curb the memory amplification vector as a result."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"risk":0.3885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97380"},"relatedVulnerabilities":[{"id":"CVE-2026-97380","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97380","cwe":"CWE-620","type":"Primary","source":"security-advisories@github.com"},{"cve":"CVE-2026-97380","cwe":"CWE-863","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-97380","date":"2026-10-25","epss":0.00777,"percentile":0.5557}],"urls":["https://github.com/MariaDB/server/commit/dbd60d0ad8daa2d01050346aa50b7b102490e456","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-625w-4hgq-qwmr","https://jira.mariadb.org/browse/MDEV-40470"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97380","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6608","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6608","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-25","epss":0.00511,"percentile":0.43314}],"risk":0.38325,"urls":["https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847307","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."},"relatedVulnerabilities":[{"id":"CVE-2026-94440","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94440","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94440","date":"2026-10-25","epss":0.00511,"percentile":0.43314}],"urls":["https://go.dev/cl/847307","https://go.dev/issue/81741","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6608"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94440","description":"Parsing a multipart form can bypass memory limits and read an arbitrarily long line into memory when the remaining limit at the start of a part is less than 400 bytes."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6617","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6617","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-25","epss":0.0049,"percentile":0.41844}],"risk":0.3675,"urls":["https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847188","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."},"relatedVulnerabilities":[{"id":"CVE-2026-97032","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97032","cwe":"CWE-362","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97032","date":"2026-10-25","epss":0.0049,"percentile":0.41844}],"urls":["https://go.dev/cl/847188","https://go.dev/cl/847313","https://go.dev/issue/81867","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://groups.google.com/g/golang-announce/c/ZPwCyRUuGBs","https://pkg.go.dev/vuln/GO-2026-6617"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97032","description":"HTTP/2 servers could end up crashing due to inadvertently modifying its HPACK encoder concurrently. This happens because the server modifies the HPACK encoder from two goroutines without synchronization: one uses the encoder to encode a HEADERS frame as part of a response sent to a client and the other modifies the encoder's table size when handling a SETTINGS frame containing SETTINGS_HEADER_TABLE_SIZE that a client sends. A malicious client can repeatedly send a request while changing the header table size to crash the server."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70459","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70459","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-25","epss":0.00721,"percentile":0.53671}],"risk":0.3605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70459"},"relatedVulnerabilities":[{"id":"CVE-2026-70459","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70459","cwe":"CWE-908","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70459","date":"2026-10-25","epss":0.00721,"percentile":0.53671}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4v4-qxw9-q72m","https://www.vulncheck.com/advisories/rsync-daemon-crash-via-malformed-file-list-entry"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70459","description":"rsync 3.0.0 before 3.5.0 contains a null pointer dereference vulnerability in the daemon child process that allows remote attackers to crash the daemon by sending a file list whose first entry is a dot entry not typed as a directory. The daemon dereferences the first file list entry as a directory structure pointer without verifying the entry type, resulting in an invalid or uninitialized pointer dereference that terminates the client connection."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6609","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6609","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-25","epss":0.0048,"percentile":0.41148}],"risk":0.36,"urls":["https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847309","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."},"relatedVulnerabilities":[{"id":"CVE-2026-78667","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78667","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78667","date":"2026-10-25","epss":0.0048,"percentile":0.41148}],"urls":["https://go.dev/cl/847309","https://go.dev/issue/81858","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6609"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78667","description":"When parsing a Range header containing a large number of small ranges, FileServer(FS), ServeContent, and ServeFile(FS) can consume an excessive amount of CPU."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6605","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6605","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"risk":0.35475,"urls":["https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847306","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."},"relatedVulnerabilities":[{"id":"CVE-2026-56866","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56866","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56866","date":"2026-10-25","epss":0.00473,"percentile":0.40665}],"urls":["https://go.dev/cl/847306","https://go.dev/issue/81740","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6605"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56866","description":"When http.Transport sends an HTTP/1 CONNECT request with a non-empty Request.Body, it writes the body directly to the connection without framing after the request headers. If the server rejects the CONNECT request with a non-2xx keep-alive response, Transport returns the connection to the idle pool. Because CONNECT requests do not have a request body, the server may interpret the trailing body bytes as a subsequent pipelined HTTP/1.1 request on the connection, leaving the pooled connection desynchronized and causing the next caller that reuses it to read the response to the injected request. In reverse proxies (including httputil.ReverseProxy) that forward CONNECT requests through a shared Transport, this can lead to cross-user response poisoning."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4155","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4155","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-25","epss":0.00457,"percentile":0.39365}],"risk":0.34275,"urls":["https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/725920","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61729","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61729","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61729","date":"2026-10-25","epss":0.00457,"percentile":0.39365}],"urls":["https://go.dev/cl/725920","https://go.dev/issue/76445","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4155"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61729","description":"Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-15043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-15043","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-25","epss":0.00671,"percentile":0.51748}],"risk":0.33549999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-15043"},"relatedVulnerabilities":[{"id":"CVE-2026-15043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-15043","cwe":"CWE-480","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-15043","date":"2026-10-25","epss":0.00671,"percentile":0.51748}],"urls":["https://github.com/perl5-dbi/dbi/commit/e9742ef85a75867cbd696860e3bf3e32b681f98d.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-mv45-ff6j-x9jp","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/9"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-15043","description":"DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted <= and >= SQL operators on text.\n\nDBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, <= was evaluated using Perl's ge operator, and >= was evaluated using Perl's le operator.\n\nSQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly.\n\nThe impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted <=/>= comparison silently returns the wrong rows."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14740","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-14740","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-25","epss":0.00661,"percentile":0.51329}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14740"},"relatedVulnerabilities":[{"id":"CVE-2026-14740","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14740","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14740","date":"2026-10-25","epss":0.00661,"percentile":0.51329}],"urls":["https://github.com/perl5-dbi/dbi/commit/fc16f9e8b3dd5c65caf1867781ab2bfe2fadcc01.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-35f4-f8m9-w8xg","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/17"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14740","description":"DBI versions before 1.650 for Perl read one byte out-of-bounds in preparse when deleting an initial SQL comment.\n\nThe preparse method normalises SQL and removes comments. When the SQL starts with a comment line, the deletion of that line during normalisation led to an out-of-bounds read by one byte. The result is a fault on memory-hardened builds and nondeterministic newline retention on normal builds."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60082","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-25","epss":0.00653,"percentile":0.51011}],"risk":0.3265,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60082"},"relatedVulnerabilities":[{"id":"CVE-2026-60082","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60082","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60082","date":"2026-10-25","epss":0.00653,"percentile":0.51011}],"urls":["https://github.com/perl5-dbi/dbi/commit/397868704291bbf0989b97e2c0661189890653e2.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-rwhc-hhmv-cjvg","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/13"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60082","description":"DBI versions before 1.651 for Perl do not enforce statement handle consistency with the row.\n\nWhen the statement handle had no fields but the source row was non-empty, the internal row-buffer helper would read from a negative array index.\n\nThis could be triggered by a caller supplying inconsistent metadata and rows to the prepare method."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6610","versionConstraint":"<1.26.9 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6610","fix":{"state":"fixed","versions":["1.26.9"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-25","epss":0.00425,"percentile":0.36529}],"risk":0.31875000000000003,"urls":["https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/835145","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."},"relatedVulnerabilities":[{"id":"CVE-2026-78660","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-78660","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-78660","date":"2026-10-25","epss":0.00425,"percentile":0.36529}],"urls":["https://go.dev/cl/835145","https://go.dev/cl/836385","https://go.dev/issue/81115","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6610"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-78660","description":"Historically, we have been rather lax about malformed framing-related headers in our HTTP/2 implementation, as they cannot interfere with HTTP/2 framing. However, this makes it possible for our HTTP/2 implementation to forward responses containing such headers to an HTTP/1 client when acting as a reverse proxy. If the HTTP/1 client also does not behave strictly enough, this can result in response smuggling."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-10-25","epss":0.0063,"percentile":0.4989}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-60081","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60081","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-25","epss":0.0063,"percentile":0.49888}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60081"},"relatedVulnerabilities":[{"id":"CVE-2026-60081","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60081","cwe":"CWE-770","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-60081","date":"2026-10-25","epss":0.0063,"percentile":0.49888}],"urls":["https://github.com/perl5-dbi/dbi/commit/6764e755e83ee1ebb1b40760e5b53eb50960bd7a.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ww49-w4mv-jrr4","https://metacpan.org/release/HMBRAND/DBI-1.651/changes","http://www.openwall.com/lists/oss-security/2026/07/14/14"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60081","description":"DBI::ProfileData versions before 1.651 for Perl do not limit the path index.\n\nThe path index column of profile dump files is used to allocate an array of data for the parser. An unbounded value allows an attacker to specify a large index and consume available memory."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53790","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53790","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-25","epss":0.00629,"percentile":0.49828}],"risk":0.3145,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53790"},"relatedVulnerabilities":[{"id":"CVE-2026-53790","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53790","cwe":"CWE-78","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53790","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53790","date":"2026-10-25","epss":0.00629,"percentile":0.49828}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-5hcf-7xxm-rmqq","https://www.vulncheck.com/advisories/rsync-command-injection-via-multiple-code-paths"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53790","description":"rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6613","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6613","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-25","epss":0.00414,"percentile":0.35461}],"risk":0.31049999999999994,"urls":["https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/847311","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP.\n\nThe impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."},"relatedVulnerabilities":[{"id":"CVE-2026-94439","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94439","cwe":"CWE-444","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94439","date":"2026-10-25","epss":0.00414,"percentile":0.35461}],"urls":["https://go.dev/cl/847311","https://go.dev/issue/81744","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6613"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94439","description":"When an HTTP server handler sends a 2xx response to an HTTP/1 CONNECT request and returns without hijacking the connection, the server improperly continues to read and serve requests from the connection. Since a 2xx response to an HTTP/1 CONNECT converts the connection into a tunnel, the server should not treat the connection as continuing to contain HTTP. The impact of this misbehavior is mostly limited to potential request smuggling, where an intermediate proxy considers the data on the connection to be tunneled and the server considers it to be HTTP."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4007","versionConstraint":"<1.24.9||>=1.25.0,<1.25.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4007","fix":{"state":"fixed","versions":["1.24.9","1.25.3"],"available":[{"date":"2025-10-13","kind":"release","version":"1.24.9"},{"date":"2025-10-13","kind":"release","version":"1.25.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-25","epss":0.00406,"percentile":0.3459}],"risk":0.3045,"urls":["https://go.dev/cl/709854","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75681","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58187","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58187","cwe":"CWE-407","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58187","date":"2026-10-25","epss":0.00406,"percentile":0.3459}],"urls":["https://go.dev/cl/709854","https://go.dev/issue/75681","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4007","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58187","description":"Due to the design of the name constraint checking algorithm, the processing time of some inputs scale non-linearly with respect to the size of the certificate. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6218","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6218","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-25","epss":0.0055,"percentile":0.45754}],"risk":0.29975,"urls":["https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/803681","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead.\n\nNow, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."},"relatedVulnerabilities":[{"id":"CVE-2026-56860","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56860","cwe":"CWE-407","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56860","date":"2026-10-25","epss":0.0055,"percentile":0.45754}],"urls":["https://go.dev/cl/803681","https://go.dev/issue/80494","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6218"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56860","description":"Previously, resolving relative paths containing parent directory ('..') segments performed string conversions and buffer rewrites on each step, resulting in quadratic time complexity and high memory allocation overhead. Now, path resolution operates on a byte buffer using index-based backtracking for '..' segments, eliminating the quadratic time complexity and significantly reducing memory allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4012","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4012","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-25","epss":0.00565,"percentile":0.46631}],"risk":0.290975,"urls":["https://go.dev/cl/709855","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75672","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-58186","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58186","date":"2026-10-25","epss":0.00565,"percentile":0.46631}],"urls":["https://go.dev/cl/709855","https://go.dev/issue/75672","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4012","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58186","description":"Despite HTTP headers having a default limit of 1MB, the number of cookies that can be parsed does not have a limit. By sending a lot of very small cookies such as \"a=;\", an attacker can make an HTTP server allocate a large amount of structs, causing large memory consumption."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70464","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70464","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-25","epss":0.00573,"percentile":0.47058}],"risk":0.2865,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70464"},"relatedVulnerabilities":[{"id":"CVE-2026-70464","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70464","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70464","date":"2026-10-25","epss":0.00573,"percentile":0.47058}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hrwq-ccf7-rw5m","https://www.vulncheck.com/advisories/rsync-connection-slot-exhaustion-dos-via-handshake-stall"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70464","description":"rsync daemon 2.0.0 before 3.5.0 contains a denial of service vulnerability that allows unauthenticated remote attackers to exhaust daemon connection slots by stalling the handshake process before or after module selection without triggering the I/O timeout. Attackers can open many simultaneous connections and trickle data at the minimum rate to avoid timeout, or stall entirely before module selection where no timeout applies, consuming all available connection slots and denying service to legitimate clients."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4011","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4011","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-25","epss":0.00556,"percentile":0.46082}],"risk":0.28634,"urls":["https://go.dev/cl/709856","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75671","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."},"relatedVulnerabilities":[{"id":"CVE-2025-58185","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58185","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58185","date":"2026-10-25","epss":0.00556,"percentile":0.46082}],"urls":["https://go.dev/cl/709856","https://go.dev/issue/75671","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4011","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58185","description":"Parsing a maliciously crafted DER payload could allocate large amounts of memory, causing memory exhaustion."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4015","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4015","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-25","epss":0.00556,"percentile":0.46081}],"risk":0.28634,"urls":["https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709859","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."},"relatedVulnerabilities":[{"id":"CVE-2025-61724","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61724","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61724","date":"2026-10-25","epss":0.00556,"percentile":0.46081}],"urls":["https://go.dev/cl/709859","https://go.dev/issue/75716","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4015","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61724","description":"The Reader.ReadResponse function constructs a response string through repeated string concatenation of lines. When the number of lines in a response is large, this can cause excessive CPU consumption."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4013","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4013","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-25","epss":0.00381,"percentile":0.31868}],"risk":0.28575,"urls":["https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709853","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method.\n\nThis affects programs which validate arbitrary certificate chains."},"relatedVulnerabilities":[{"id":"CVE-2025-58188","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58188","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58188","date":"2026-10-25","epss":0.00381,"percentile":0.31868}],"urls":["https://go.dev/cl/709853","https://go.dev/issue/75675","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4013","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58188","description":"Validating certificate chains which contain DSA public keys can cause programs to panic, due to a interface cast that assumes they implement the Equal method. This affects programs which validate arbitrary certificate chains."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70461","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70461","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-25","epss":0.0057,"percentile":0.46888}],"risk":0.28500000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70461"},"relatedVulnerabilities":[{"id":"CVE-2026-70461","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70461","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70461","date":"2026-10-25","epss":0.0057,"percentile":0.46888}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-jhxm-j4mq-3fj4","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-files-from-entry"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70461","description":"rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70455","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-25","epss":0.00566,"percentile":0.46695}],"risk":0.28300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70455"},"relatedVulnerabilities":[{"id":"CVE-2026-70455","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70455","cwe":"CWE-770","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70455","date":"2026-10-25","epss":0.00566,"percentile":0.46695}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-rjvj-qgqg-cvx9","https://www.vulncheck.com/advisories/rsync-dos-via-zt-zstandard-compression-thread-exhaustion"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70455","description":"rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"risk":0.2765,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-10-25","epss":0.00553,"percentile":0.4594}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85745","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85745","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"risk":0.267,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85745"},"relatedVulnerabilities":[{"id":"CVE-2026-85745","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85745","cwe":"CWE-126","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85745","date":"2026-10-25","epss":0.00534,"percentile":0.44792}],"urls":["https://github.com/MariaDB/server/commit/2bf355e361db85153fdfba7b8a0f0d114d6a26ce","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-p7v9-24h4-mch8","https://jira.mariadb.org/browse/MDEV-40328"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85745","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4946","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4946","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-25","epss":0.00355,"percentile":0.28947}],"risk":0.26625,"urls":["https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/758061","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.\n\nThis only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."},"relatedVulnerabilities":[{"id":"CVE-2026-32281","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32281","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32281","date":"2026-10-25","epss":0.00355,"percentile":0.28947}],"urls":["https://go.dev/cl/758061","https://go.dev/issue/78281","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4946"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32281","description":"Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70453","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70453","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-25","epss":0.00525,"percentile":0.44234}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70453"},"relatedVulnerabilities":[{"id":"CVE-2026-70453","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70453","cwe":"CWE-407","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70453","date":"2026-10-25","epss":0.00525,"percentile":0.44234}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-8x5r-mjx8-83hv","https://www.vulncheck.com/advisories/rsync-algorithmic-complexity-dos-via-hash-search"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70453","description":"rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107708","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107708","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107708"},"relatedVulnerabilities":[{"id":"CVE-2026-107708","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107708","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107708","date":"2026-10-25","epss":0.00521,"percentile":0.43946}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/kdc/kdc_util.c#L639-L676","https://github.com/krb5/krb5/commit/a88a18cafa1040a0c4f9c8d08288fc98831ec86d","https://github.com/krb5/krb5/commit/f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7","https://github.com/krb5/krb5/pull/1510","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-kdc-null-pointer-dereference-via-s4u2proxy-pac"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107708","description":"MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-10-25","epss":0.00517,"percentile":0.43737}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107822","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107822","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"risk":0.258,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107822"},"relatedVulnerabilities":[{"id":"CVE-2026-107822","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107822","cwe":"CWE-706","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-107822","cwe":"CWE-863","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107822","date":"2026-10-25","epss":0.00516,"percentile":0.43646}],"urls":["https://github.com/MariaDB/server/commit/67ea07dd3400004e4f7ae01bf977f4344bbe064b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2m85-2x26-36rf","https://jira.mariadb.org/browse/MDEV-40541"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107822","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB's ACL cache could generate the same database-privilege cache key for role and localhost user names that matched because both used an empty IP component. An attacker with CREATE USER could create the colliding principal and, when the original principal's database privileges were cached, exercise privileges assigned to the other account. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53794","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-25","epss":0.00507,"percentile":0.42953}],"risk":0.2535,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53794"},"relatedVulnerabilities":[{"id":"CVE-2026-53794","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53794","cwe":"CWE-1284","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53794","date":"2026-10-25","epss":0.00507,"percentile":0.42953}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p827-vwcp-m964","https://www.vulncheck.com/advisories/rsync-denial-of-service-via-max-alloc-0-logic-error"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53794","description":"rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53791","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53791","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-25","epss":0.00501,"percentile":0.42613}],"risk":0.2505,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53791"},"relatedVulnerabilities":[{"id":"CVE-2026-53791","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53791","cwe":"CWE-290","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53791","date":"2026-10-25","epss":0.00501,"percentile":0.42613}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-h2q9-5fr8-w635","https://www.vulncheck.com/advisories/rsync-daemon-ip-spoofing-via-proxy-protocol-header"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53791","description":"rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14380","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-14380","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-25","epss":0.00499,"percentile":0.42465}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14380"},"relatedVulnerabilities":[{"id":"CVE-2026-14380","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14380","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-14380","cwe":"CWE-470","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14380","date":"2026-10-25","epss":0.00499,"percentile":0.42465}],"urls":["https://github.com/perl5-dbi/dbi/commit/b73d5d9901767fc1d16b6661ef08fbed4532e259.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-ch8w-hxc2-v557","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","http://www.openwall.com/lists/oss-security/2026/07/07/16"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14380","description":"DBI versions before 1.650 for Perl are vulnerable to code injection via caller-influenced Profile.\n\nWhen a string is assigned to a DBI handle's Profile attribute, DBI splits it into path, package and arguments, and interpolates the package part in a string eval with no validation of the package name.\n\nAny caller-influenced value that reaches the Profile attribute is therefore arbitrary Perl code execution, including calls to run system commands.\n\nThe Profile attribute can be set from three different sources that can carry untrusted data: the DBI_PROFILE environment variable, a direct attribute assignment, and a DSN driver-attribute clause dbi:Driver(Profile=>SPEC):db.\n\nAn attacker controlling any of those inputs runs arbitrary Perl in the host process. The strongest remote position is a network-exposed DBI::Gofer / DBI::ProxyServer whose per-request DSN reaches the Profile attribute, letting a client execute code on the broker host."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86047","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86047","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"risk":0.246,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86047"},"relatedVulnerabilities":[{"id":"CVE-2026-86047","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.8,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86047","cwe":"CWE-89","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-86047","date":"2026-10-25","epss":0.00492,"percentile":0.41997}],"urls":["https://github.com/MariaDB/server/commit/2b28d1c424104429eeed43115ee6d8a803671d52","https://github.com/MariaDB/server/commit/3646569225758c8225e7342783d775ef7c7570e5","https://github.com/MariaDB/server/commit/5acb43522863c9bd6b91f354104ea247bf513e9a","https://github.com/MariaDB/server/commit/9d4ffe23b25808f7858b2dc48106fbd60cf0e513","https://github.com/MariaDB/server/commit/d5d741a3076f911b468518d6b06a917593498c5b","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wxr3-wm3p-7w6p","https://jira.mariadb.org/browse/MDEV-39776","https://jira.mariadb.org/browse/MDEV-39818","https://jira.mariadb.org/browse/MDEV-40308","https://jira.mariadb.org/browse/MDEV-40311","https://jira.mariadb.org/browse/MDEV-40312"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86047","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107814","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107814","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"risk":0.24450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107814"},"relatedVulnerabilities":[{"id":"CVE-2026-107814","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107814","cwe":"CWE-732","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107814","date":"2026-10-25","epss":0.00489,"percentile":0.41761}],"urls":["https://github.com/MariaDB/server/commit/d842d6e994a8b0d67c280bf785a11357d6b316a2","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-m5gf-432r-g5jw"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107814","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, MariaDB RPM packages created the dedicated mysql service account with the database data directory as its home directory. A database user with the FILE privilege could write startup dot-files such as .bash_profile into $HOME, and those files could execute when an administrator opened a login shell for the mysql account. Debian packages are not affected because they use /nonexistent as the account home. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-10-25","epss":0.00486,"percentile":0.41523}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-10-25","epss":0.00486,"percentile":0.41519}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4008","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4008","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-25","epss":0.00468,"percentile":0.40209}],"risk":0.24101999999999998,"urls":["https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/707776","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."},"relatedVulnerabilities":[{"id":"CVE-2025-58189","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-58189","cwe":"CWE-532","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-58189","date":"2026-10-25","epss":0.00468,"percentile":0.40209}],"urls":["https://go.dev/cl/707776","https://go.dev/issue/75652","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4008","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58189","description":"When Conn.Handshake fails during ALPN negotiation the error contains attacker controlled information (the ALPN protocols sent by the client) which is not escaped."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4010","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4010","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-25","epss":0.00468,"percentile":0.40209}],"risk":0.24101999999999998,"urls":["https://go.dev/cl/709857","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/75678","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."},"relatedVulnerabilities":[{"id":"CVE-2025-47912","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47912","date":"2026-10-25","epss":0.00468,"percentile":0.40209}],"urls":["https://go.dev/cl/709857","https://go.dev/issue/75678","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4010","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47912","description":"The Parse function permits values other than IPv6 addresses to be included in square brackets within the host component of a URL. RFC 3986 permits IPv6 addresses to be included within the host component, enclosed within square brackets. For example: \"http://[::1]/\". IPv4 addresses and hostnames must not appear within square brackets. Parse did not enforce this requirement."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70452","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70452","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-25","epss":0.00462,"percentile":0.39786}],"risk":0.231,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70452"},"relatedVulnerabilities":[{"id":"CVE-2026-70452","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70452","cwe":"CWE-636","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70452","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70452","date":"2026-10-25","epss":0.00462,"percentile":0.39786}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-6692-28cx-wpqq","https://www.vulncheck.com/advisories/rsync-access-control-bypass-via-dns-resolution-failure"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70452","description":"rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"risk":0.22899999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-10-25","epss":0.00458,"percentile":0.39439}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70462","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70462","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-25","epss":0.00452,"percentile":0.38991}],"risk":0.22599999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70462"},"relatedVulnerabilities":[{"id":"CVE-2026-70462","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70462","cwe":"CWE-190","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70462","cwe":"CWE-835","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70462","date":"2026-10-25","epss":0.00452,"percentile":0.38991}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-j9wh-5jmp-2m64","https://www.vulncheck.com/advisories/rsync-signed-integer-overflow-via-msg-io-timeout"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70462","description":"rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-10-25","epss":0.0045,"percentile":0.38822}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70460","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70460","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-25","epss":0.00448,"percentile":0.38664}],"risk":0.22399999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70460"},"relatedVulnerabilities":[{"id":"CVE-2026-70460","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70460","cwe":"CWE-22","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70460","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70460","date":"2026-10-25","epss":0.00448,"percentile":0.38664}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-w3xf-j2r2-gv4x","https://www.vulncheck.com/advisories/rsync-path-traversal-via-partial-dir-backup-dir-symlink"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70460","description":"rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-10-25","epss":0.00439,"percentile":0.37903}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-10-25","epss":0.00436,"percentile":0.37599}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53798","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-25","epss":0.00428,"percentile":0.3681}],"risk":0.214,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53798"},"relatedVulnerabilities":[{"id":"CVE-2026-53798","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53798","cwe":"CWE-704","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53798","date":"2026-10-25","epss":0.00428,"percentile":0.3681}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-hx7p-3gvv-pqgv","https://www.vulncheck.com/advisories/rsync-privilege-confusion-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53798","description":"rsync before 3.5.0 contains a privilege confusion vulnerability in the name-converter subprocess uid/gid mapping that allows local attackers to cause transferred files to be owned by root by influencing name-converter responses to return empty values. When the name-converter subprocess returns an empty response for a uid or gid lookup, rsync incorrectly interprets it as a successful resolution to uid/gid 0 (root) rather than a lookup failure, and if the name-converter also signals fake super-user status, rsync proceeds with root ownership assignments for transferred files."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101768","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101768","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"risk":0.21350000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101768"},"relatedVulnerabilities":[{"id":"CVE-2026-101768","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101768","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101768","date":"2026-10-25","epss":0.00427,"percentile":0.36684}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101768","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via HTTP to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in takeover of MySQL Connectors. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-25","epss":0.00425,"percentile":0.36449}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-25","epss":0.00425,"percentile":0.36449}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"024677f03ba4b41d","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-25","epss":0.00425,"percentile":0.36449}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-10-25","epss":0.00425,"percentile":0.36449}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"a14a21eb8bcc5f1a","cpes":["cpe:2.3:a:libgssapi-krb5-2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5-2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5_2:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi-krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi_krb5:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi-krb5-2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libgssapi:libgssapi_krb5_2:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libgssapi-krb5-2","purl":"pkg:deb/ubuntu/libgssapi-krb5-2@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgssapi-krb5-2/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libgssapi-krb5-2/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libgssapi-krb5-2:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"d43699c9cd5719fa","cpes":["cpe:2.3:a:libk5crypto3:libk5crypto3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libk5crypto3","purl":"pkg:deb/ubuntu/libk5crypto3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libk5crypto3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libk5crypto3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libk5crypto3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"e0334529fa08f0c3","cpes":["cpe:2.3:a:libkrb5-3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5-3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5_3:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5-3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*","cpe:2.3:a:libkrb5:libkrb5_3:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5-3","purl":"pkg:deb/ubuntu/libkrb5-3@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5-3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libkrb5-3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libkrb5-3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"7ab07b2789627097","cpes":["cpe:2.3:a:libkrb5support0:libkrb5support0:1.22.1-2ubuntu4.1:*:*:*:*:*:*:*"],"name":"libkrb5support0","purl":"pkg:deb/ubuntu/libkrb5support0@1.22.1-2ubuntu4.1?arch=amd64&distro=ubuntu-26.04&upstream=krb5","type":"deb","version":"1.22.1-2ubuntu4.1","language":"","licenses":["sha256:936728f4181718f42951b881c1e8f1386bf6b2723c4fbc533c374d6f42c71816"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libkrb5support0/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libkrb5support0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libkrb5support0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"krb5"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"krb5","version":"1.22.1-2ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107778","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"risk":0.212,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107778"},"relatedVulnerabilities":[{"id":"CVE-2026-107778","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107778","cwe":"CWE-476","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-107778","date":"2026-10-25","epss":0.00424,"percentile":0.36425}],"urls":["https://github.com/krb5/krb5","https://github.com/krb5/krb5/blob/krb5-1.22.2-final/src/lib/krb5/krb/rd_cred.c#L77-L112","https://github.com/krb5/krb5/commit/48afa9abb89ab2176bb20624d87d010b9984fc08","https://github.com/krb5/krb5/commit/62196e2b269159a5465f5b8d0ed7cf6f29c3282a","https://github.com/krb5/krb5/pull/1511","https://www.vulncheck.com/advisories/mit-krb5-through-1.22.2-null-pointer-dereference-via-krb5-rd-cred"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107778","description":"MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-10-25","epss":0.00422,"percentile":0.36274}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"a4c08556febfed08","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.7-0.1?arch=all&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-25","epss":0.0042,"percentile":0.36052}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-25","epss":0.0042,"percentile":0.36052}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"5280e800b6813f21","cpes":["cpe:2.3:a:libtirpc3t64:libtirpc3t64:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc3t64","purl":"pkg:deb/ubuntu/libtirpc3t64@1.3.7-0.1?arch=amd64&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3t64/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libtirpc3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85977","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85977","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-25","epss":0.0042,"percentile":0.36052}],"risk":0.21,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85977"},"relatedVulnerabilities":[{"id":"CVE-2026-85977","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85977","cwe":"CWE-1050","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85977","date":"2026-10-25","epss":0.0042,"percentile":0.36052}],"urls":["https://access.redhat.com/errata/RHSA-2026:80360","https://access.redhat.com/security/cve/CVE-2026-85977","https://bugzilla.redhat.com/show_bug.cgi?id=2478979"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85977","description":"A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-10-25","epss":0.00416,"percentile":0.35622}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-14739","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-14739","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-25","epss":0.00413,"percentile":0.35295}],"risk":0.2065,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-14739"},"relatedVulnerabilities":[{"id":"CVE-2026-14739","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-14739","cwe":"CWE-787","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-14739","date":"2026-10-25","epss":0.00413,"percentile":0.35295}],"urls":["https://github.com/perl5-dbi/dbi/commit/2b77c88b655e9539a592c71a61fb965fc0075395.patch","https://metacpan.org/release/HMBRAND/DBI-1.650/changes","https://www.cve.org/CVERecord?id=CVE-2026-10879"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-14739","description":"DBI versions before 1.650 for Perl have a heap overflow when preparsing SQL statements with an extreme number of placeholders.\n\nThe fix for CVE-2026-10879 did not allocate enough memory to handle approximately 1.2-million placeholders.\n\nDBI version 1.650 sets a hard limit of 99,999 placeholders."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4014","versionConstraint":"<1.24.8||>=1.25.0,<1.25.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4014","fix":{"state":"fixed","versions":["1.24.8","1.25.2"],"available":[{"date":"2025-10-07","kind":"release","version":"1.24.8"},{"date":"2025-10-07","kind":"release","version":"1.25.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-25","epss":0.00443,"percentile":0.38221}],"risk":0.20599499999999996,"urls":["https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/709861","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."},"relatedVulnerabilities":[{"id":"CVE-2025-58183","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-58183","date":"2026-10-25","epss":0.00443,"percentile":0.38221}],"urls":["https://go.dev/cl/709861","https://go.dev/issue/75677","https://groups.google.com/g/golang-announce/c/4Emdl2iQ_bI","https://pkg.go.dev/vuln/GO-2025-4014","http://www.openwall.com/lists/oss-security/2025/10/08/1"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-58183","description":"tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archive into memory. When reading from a compressed source, a small compressed input can result in large allocations."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4980","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4980","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-25","epss":0.00371,"percentile":0.30774}],"risk":0.20590499999999998,"urls":["https://go.dev/cl/771180","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78981","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."},"relatedVulnerabilities":[{"id":"CVE-2026-39826","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39826","cwe":"CWE-116","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39826","date":"2026-10-25","epss":0.00371,"percentile":0.30774}],"urls":["https://go.dev/cl/771180","https://go.dev/issue/78981","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4980"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39826","description":"If a trusted template author were to write a <script> tag containing an empty 'type' attribute or a 'type' attribute with an ASCII whitespace, the execution of the template would incorrectly escape any data passed into the <script> block."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4976","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4976","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-25","epss":0.0039,"percentile":0.32884}],"risk":0.20084999999999997,"urls":["https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/770541","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions.\n\nWhen used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function.\n\nFor example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."},"relatedVulnerabilities":[{"id":"CVE-2026-39825","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-39825","date":"2026-10-25","epss":0.0039,"percentile":0.32884}],"urls":["https://go.dev/cl/770541","https://go.dev/issue/78948","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4976"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39825","description":"ReverseProxy can forward queries containing parameters not visible to Rewrite functions. When used with a Rewrite function, or a Director function which parses query parameters, ReverseProxy sanitizes the forwarded request to remove query parameters which are not parsed by url.ParseQuery. ReverseProxy does not take ParseQuery's limit on the total number of query parameters (controlled by GODEBUG=urlmaxqueryparams=N) into account. This can permit ReverseProxy to forward a request containing a query parameter that is not visible to the Rewrite function. For example, the query \"a1=x&a2=x&...&a10000=x&hidden=y\" can forward the parameter \"hidden=y\" while hiding it from the proxy's Rewrite function."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107818","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107818","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107818"},"relatedVulnerabilities":[{"id":"CVE-2026-107818","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":6.1,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107818","cwe":"CWE-15","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107818","date":"2026-10-25","epss":0.00401,"percentile":0.3411}],"urls":["https://github.com/MariaDB/server/commit/e3d62d4e78fd4941cef3f5053e6a50d0b32d740e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-mhvc-vqcq-7vq5","https://jira.mariadb.org/browse/MDEV-40629"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107818","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the mariadb.service unit used /run/mysqld/wsrep-new-cluster during the next service restart. A database user with FILE privilege and a secure-file-priv configuration permitting writes to /run/mysqld could create that file and inject attacker-controlled environment values into the restarted service. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"73ed94197798fce7","cpes":["cpe:2.3:a:libelf1t64:libelf1t64:0.194-4:*:*:*:*:*:*:*"],"name":"libelf1t64","purl":"pkg:deb/ubuntu/libelf1t64@0.194-4?arch=amd64&distro=ubuntu-26.04&upstream=elfutils","type":"deb","version":"0.194-4","language":"","licenses":["GFDL-1.3","GFDL-NIV-1.3","GPL-2","GPL-3","GPL-3+","LGPL-2.1","LGPL-2.1+","LGPL-3","LGPL-3+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libelf1t64/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libelf1t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libelf1t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"elfutils"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-1352","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"elfutils","version":"0.194-4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2025-1352","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-25","epss":0.00665,"percentile":0.51504}],"risk":0.19949999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-1352"},"relatedVulnerabilities":[{"id":"CVE-2025-1352","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"impactScore":5.9,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"impactScore":3.4,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cna@vuldb.com","vector":"AV:N/AC:H/Au:N/C:P/I:P/A:P","metrics":{"baseScore":5.1,"impactScore":6.5,"exploitabilityScore":5},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-1352","cwe":"CWE-119","type":"Secondary","source":"cna@vuldb.com"}],"epss":[{"cve":"CVE-2025-1352","date":"2026-10-25","epss":0.00665,"percentile":0.51504}],"urls":["https://sourceware.org/bugzilla/attachment.cgi?id=15923","https://sourceware.org/bugzilla/show_bug.cgi?id=32650","https://sourceware.org/bugzilla/show_bug.cgi?id=32650#c2","https://vuldb.com/?ctiid.295960","https://vuldb.com/?id.295960","https://vuldb.com/?submit.495965","https://www.gnu.org/","https://cert-portal.siemens.com/productcert/html/ssa-253495.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-1352","description":"A vulnerability has been found in GNU elfutils 0.192 and classified as critical. This vulnerability affects the function __libdw_thread_tail in the library libdw_alloc.c of the component eu-readelf. The manipulation of the argument w leads to memory corruption. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The name of the patch is 2636426a091bd6c6f7f02e49ab20d4cdc6bfc753. It is recommended to apply a patch to fix this issue."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53786","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53786","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-25","epss":0.00398,"percentile":0.33769}],"risk":0.199,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53786"},"relatedVulnerabilities":[{"id":"CVE-2026-53786","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53786","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53786","date":"2026-10-25","epss":0.00398,"percentile":0.33769}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mrc3-6cwx-hch6","https://www.vulncheck.com/advisories/rsync-filter-rule-bypass-via-filter-merge-directive"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53786","description":"rsync before 3.5.0 contains a filter rule bypass vulnerability that allows authenticated clients to override module-level filter restrictions by supplying malicious --filter merge file directives. Attackers can inject client-side merge file directives during filter evaluation to introduce rules that supersede daemon module-level restrictions, gaining access to files the module filter was intended to exclude."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53795","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53795","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-25","epss":0.00396,"percentile":0.33571}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53795"},"relatedVulnerabilities":[{"id":"CVE-2026-53795","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53795","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53795","date":"2026-10-25","epss":0.00396,"percentile":0.33571}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-m9vj-637x-v6pq","https://www.vulncheck.com/advisories/rsync-arbitrary-file-write-via-temp-dir-link-dest"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53795","description":"rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70456","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70456","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-25","epss":0.00396,"percentile":0.33488}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70456"},"relatedVulnerabilities":[{"id":"CVE-2026-70456","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70456","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70456","date":"2026-10-25","epss":0.00396,"percentile":0.33488}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-78jc-79jv-v6rw","https://www.vulncheck.com/advisories/rsync-heap-out-of-bounds-write-via-read-args"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70456","description":"rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70458","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70458","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-25","epss":0.00396,"percentile":0.33487}],"risk":0.198,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70458"},"relatedVulnerabilities":[{"id":"CVE-2026-70458","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.8},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70458","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70458","date":"2026-10-25","epss":0.00396,"percentile":0.33487}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-gg3m-4m9m-268h","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-flag-hlinked-handling"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70458","description":"rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5856","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5856","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-25","epss":0.00382,"percentile":0.31958}],"risk":0.19673,"urls":["https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/775960","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."},"relatedVulnerabilities":[{"id":"CVE-2026-42505","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42505","cwe":"CWE-201","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-42505","date":"2026-10-25","epss":0.00382,"percentile":0.31958}],"urls":["https://go.dev/cl/775960","https://go.dev/issue/79282","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-5856"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42505","description":"Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53793","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53793","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-25","epss":0.00393,"percentile":0.33219}],"risk":0.1965,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53793"},"relatedVulnerabilities":[{"id":"CVE-2026-53793","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53793","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53793","date":"2026-10-25","epss":0.00393,"percentile":0.33219}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-wj7w-vh23-mm44","https://www.vulncheck.com/advisories/rsync-path-confinement-bypass-via-boundary-marker-in-chroot-mode"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53793","description":"rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-5039","versionConstraint":"<1.25.11||>=1.26.0-0,<1.26.4 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-5039","fix":{"state":"fixed","versions":["1.25.11","1.26.4"],"available":[{"date":"2026-06-02","kind":"release","version":"1.25.11"},{"date":"2026-06-02","kind":"release","version":"1.26.4"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-25","epss":0.0037,"percentile":0.3069}],"risk":0.19055,"urls":["https://go.dev/cl/777060","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79346","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."},"relatedVulnerabilities":[{"id":"CVE-2026-42507","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-42507","date":"2026-10-25","epss":0.0037,"percentile":0.3069}],"urls":["https://go.dev/cl/777060","https://go.dev/issue/79346","https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw","https://pkg.go.dev/vuln/GO-2026-5039"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42507","description":"When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.8"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4603","versionConstraint":"<1.25.8||>=1.26.0-0,<1.26.1 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4603","fix":{"state":"fixed","versions":["1.25.8","1.26.1"],"available":[{"date":"2026-03-06","kind":"release","version":"1.25.8"},{"date":"2026-03-06","kind":"release","version":"1.26.1"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-25","epss":0.00341,"percentile":0.27333}],"risk":0.18925499999999998,"urls":["https://go.dev/issue/77954","https://go.dev/cl/752081"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\".\n\nA new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."},"relatedVulnerabilities":[{"id":"CVE-2026-27142","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-27142","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-27142","date":"2026-10-25","epss":0.00341,"percentile":0.27333}],"urls":["https://go.dev/cl/752081","https://go.dev/issue/77954","https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk","https://pkg.go.dev/vuln/GO-2026-4603"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27142","description":"Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value \"refresh\". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow \"url=\" by setting htmlmetacontenturlescape=0."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70457","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70457","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-25","epss":0.00377,"percentile":0.31415}],"risk":0.1885,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70457"},"relatedVulnerabilities":[{"id":"CVE-2026-70457","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.3},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70457","cwe":"CWE-131","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-70457","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70457","date":"2026-10-25","epss":0.00377,"percentile":0.31415}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pg7g-xqmr-xpfh","https://www.vulncheck.com/advisories/rsync-out-of-bounds-write-via-parse-size-arg"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70457","description":"rsync 3.2.3 before 3.5.0 contains an out-of-bounds write in parse_size_arg() where the return value of snprintf() is used directly as an index into a .bss-segment array without bounds checking. When snprintf truncates the formatted size string, the return value equals the number of characters that would have been written including the truncated portion, and this value may exceed the array length. The subsequent indexed write targets memory outside the intended array bounds, corrupting .bss memory."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-10-25","epss":0.00375,"percentile":0.31241}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53783","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53783","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-25","epss":0.00374,"percentile":0.3109}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53783"},"relatedVulnerabilities":[{"id":"CVE-2026-53783","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53783","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53783","cwe":"CWE-88","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53783","date":"2026-10-25","epss":0.00374,"percentile":0.3109}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-9cgc-64g4-3gv5","https://www.vulncheck.com/advisories/rsync-toctou-race-condition-directory-escape-via-rrsync"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53783","description":"rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-70463","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-70463","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-25","epss":0.00364,"percentile":0.29969}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-70463"},"relatedVulnerabilities":[{"id":"CVE-2026-70463","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.6},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-70463","cwe":"CWE-863","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-70463","date":"2026-10-25","epss":0.00364,"percentile":0.29969}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-pfj8-79vq-xgvr","https://www.vulncheck.com/advisories/rsync-authorization-bypass-via-auth-users-directive-parsing"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-70463","description":"rsync 3.1.0 before 3.5.0 contains an authorization bypass in auth users directive parsing. The auth users parser uses comma-only tokenization when splitting the user list, which fails to correctly handle entries of the form @Group Name where the group name contains a space. The space within the group name causes the parser to split the entry at the space boundary, discarding the deny rule associated with the group. An authenticated user whose username or group membership would be denied by an @Group Name auth users entry can connect to a restricted module because the deny rule is silently discarded during parsing."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-10-25","epss":0.0036,"percentile":0.29496}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-10-25","epss":0.00359,"percentile":0.29317}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-10-25","epss":0.00359,"percentile":0.29316}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53789","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-25","epss":0.00357,"percentile":0.29176}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53789"},"relatedVulnerabilities":[{"id":"CVE-2026-53789","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.2,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53789","cwe":"CWE-807","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53789","date":"2026-10-25","epss":0.00357,"percentile":0.29176}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-fxwg-7hmf-xh5q","https://www.vulncheck.com/advisories/rsync-arbitrary-file-deletion-via-malicious-file-list"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53789","description":"rsync before 3.5.0 contains an improper path handling vulnerability that allows a malicious sender to expand the scope of --delete operations beyond the intended destination subtree by sending a crafted file list that causes rsync to reclassify implied parent directory entries or treat synthetic paths as the transfer root. Attackers can exploit multiple variants including implied parent reclassification, synthetic root path construction, legacy protocol behavior below version 30, and non-directory root handling to cause the receiver to delete files outside the authorized destination directory."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4970","versionConstraint":"<1.25.12||>=1.26.0-0,<1.26.5||>=1.27.0-0,<1.27.0-rc.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4970","fix":{"state":"fixed","versions":["1.25.12","1.26.5","1.27.0-rc.2"],"available":[{"date":"2026-07-07","kind":"release","version":"1.25.12"},{"date":"2026-07-07","kind":"release","version":"1.26.5"},{"date":"2026-07-07","kind":"release","version":"1.27.0-rc.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-25","epss":0.00232,"percentile":0.13988}],"risk":0.17748,"urls":["https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://go.dev/cl/797880"],"severity":"High","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/79005","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /.\n\nFor example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."},"relatedVulnerabilities":[{"id":"CVE-2026-39822","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39822","cwe":"CWE-61","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-39822","date":"2026-10-25","epss":0.00232,"percentile":0.13988}],"urls":["https://go.dev/cl/797880","https://go.dev/issue/79005","https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc","https://pkg.go.dev/vuln/GO-2026-4970"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39822","description":"On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open(\"symlink/\")' will open \"symlink\" even when \"symlink\" is a symbolic link pointing outside of the root."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-10-25","epss":0.00353,"percentile":0.28707}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"2e367656835698a0","cpes":["cpe:2.3:a:libperl5.40:libperl5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"libperl5.40","purl":"pkg:deb/ubuntu/libperl5.40@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libperl5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libperl5.40:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"48a76947c1328996","cpes":["cpe:2.3:a:perl:perl:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"cd714f2b10ca1a58","cpes":["cpe:2.3:a:perl-base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.40.1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/perl-base.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"9bb463683b719f6f","cpes":["cpe:2.3:a:perl-modules-5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.40:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.40:5.40.1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"perl-modules-5.40","purl":"pkg:deb/ubuntu/perl-modules-5.40@5.40.1-7ubuntu0.3?arch=all&distro=ubuntu-26.04&upstream=perl","type":"deb","version":"5.40.1-7ubuntu0.3","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","FSFAP","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","LGPL-2.1","REGCOMP","REGCOMP,","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.40/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/perl-modules-5.40/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.40.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/perl-modules-5.40.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"perl","version":"5.40.1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"risk":0.1745,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-10-25","epss":0.00349,"percentile":0.28218}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4982","versionConstraint":"<1.25.10||>=1.26.0-0,<1.26.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4982","fix":{"state":"fixed","versions":["1.25.10","1.26.3"],"available":[{"date":"2026-05-07","kind":"release","version":"1.25.10"},{"date":"2026-05-07","kind":"release","version":"1.26.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-25","epss":0.00314,"percentile":0.24117}],"risk":0.17426999999999998,"urls":["https://go.dev/cl/769920","https://groups.google.com/g/golang-announce/c/qcCIEXso47M"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/78913","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-39823","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-39823","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-39823","date":"2026-10-25","epss":0.00314,"percentile":0.24117}],"urls":["https://go.dev/cl/769920","https://go.dev/issue/78913","https://groups.google.com/g/golang-announce/c/qcCIEXso47M","https://pkg.go.dev/vuln/GO-2026-4982"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-39823","description":"CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a <meta> tag's <content> attribute. If the URL content were to insert ASCII whitespaces around the '=' rune inside of the <content> attribute, the escaper would fail to similarly escape it, leading to XSS."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-25","epss":0.00348,"percentile":0.28161}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-25","epss":0.00348,"percentile":0.28161}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"024677f03ba4b41d","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-25","epss":0.00348,"percentile":0.28161}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-10-25","epss":0.00348,"percentile":0.28161}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107819","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107819","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107819"},"relatedVulnerabilities":[{"id":"CVE-2026-107819","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107819","cwe":"CWE-297","type":"Primary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107819","date":"2026-10-25","epss":0.00346,"percentile":0.27919}],"urls":["https://github.com/MariaDB/server/security/advisories/GHSA-fmq9-qjxj-qpf7","https://github.com/mariadb-corporation/mariadb-connector-c/commit/e8c0a16d94ddf844668d684a7d42b37ac8e0fc02","https://github.com/mariadb-corporation/mariadb-connector-c/releases/tag/v3.4.10","https://jira.mariadb.org/browse/CONC-846"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107819","description":"MariaDB Connector/C is a C and C++ client library for connecting applications to MariaDB and MySQL databases. From 3.4.1 until 3.4.10, the MariaDB Connector/C libmariadb Zero-Configuration SSL authentication-switch logic checked certificate trust failure but did not reject a TLS hostname verification mismatch before selecting a non-hashing authentication plugin. An active man-in-the-middle attacker with a valid certificate for another hostname could request mysql_clear_password and obtain the database password inside the attacker-controlled TLS connection. Other MariaDB connectors are not affected. This issue is fixed in version 3.4.10."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101626","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101626","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101626"},"relatedVulnerabilities":[{"id":"CVE-2026-101626","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101626","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101626","date":"2026-10-25","epss":0.00345,"percentile":0.27769}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101626","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks of this vulnerability can result in  unauthorized access to critical data or complete access to all MySQL Connectors accessible data. CVSS 3.1 Base Score 5.9 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-107816","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-107816","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"risk":0.1725,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-107816"},"relatedVulnerabilities":[{"id":"CVE-2026-107816","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L","metrics":{"baseScore":6.4,"impactScore":2.8,"exploitabilityScore":3.2},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-107816","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-107816","date":"2026-10-25","epss":0.00345,"percentile":0.27741}],"urls":["https://github.com/MariaDB/server/commit/0931994096b84ecc9ffc8eb3517c7e09e6e8631e","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-wfqg-88r5-55f6","https://jira.mariadb.org/browse/MDEV-40670"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-107816","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the qc_info plugin could be confused by a query containing embedded null bytes. Reading information_schema.query_cache_info after such a query was cached could access data beyond the end of a heap-allocated buffer, potentially disclosing adjacent memory or crashing the server. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.13"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6091","versionConstraint":"<1.25.13||>=1.26.0-0,<1.26.6||>=1.27.0-0,<1.27.0-rc.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6091","fix":{"state":"fixed","versions":["1.25.13","1.26.6","1.27.0-rc.3"],"available":[{"date":"2026-08-13","kind":"release","version":"1.25.13"},{"date":"2026-08-13","kind":"release","version":"1.26.6"},{"date":"2026-08-13","kind":"release","version":"1.27.0-rc.3"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-25","epss":0.0031,"percentile":0.2357}],"risk":0.17204999999999998,"urls":["https://go.dev/cl/807100","https://groups.google.com/g/golang-announce/c/94pEornpRlI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/issue/80435","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."},"relatedVulnerabilities":[{"id":"CVE-2026-56858","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-56858","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-56858","date":"2026-10-25","epss":0.0031,"percentile":0.2357}],"urls":["https://go.dev/cl/807100","https://go.dev/issue/80435","https://groups.google.com/g/golang-announce/c/94pEornpRlI","https://pkg.go.dev/vuln/GO-2026-6091"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-56858","description":"Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.12"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4340","versionConstraint":"<1.24.12||>=1.25.0,<1.25.6 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4340","fix":{"state":"fixed","versions":["1.24.12","1.25.6"],"available":[{"date":"2026-01-15","kind":"release","version":"1.24.12"},{"date":"2026-01-15","kind":"release","version":"1.25.6"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-25","epss":0.00324,"percentile":0.25178}],"risk":0.16685999999999998,"urls":["https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/724120","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."},"relatedVulnerabilities":[{"id":"CVE-2025-61730","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-61730","date":"2026-10-25","epss":0.00324,"percentile":0.25178}],"urls":["https://go.dev/cl/724120","https://go.dev/issue/76443","https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc","https://pkg.go.dev/vuln/GO-2026-4340"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61730","description":"During the TLS 1.3 handshake if multiple messages are sent in records that span encryption level boundaries (for instance the Client Hello and Encrypted Extensions messages), the subsequent messages may be processed before the encryption level changes. This can cause some minor information disclosure if a network-local attacker can inject messages during the handshake."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101678","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101678","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"risk":0.1665,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101678"},"relatedVulnerabilities":[{"id":"CVE-2026-101678","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101678","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101678","date":"2026-10-25","epss":0.00333,"percentile":0.26243}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101678","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Connectors. CVSS 3.1 Base Score 4.3 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4864","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4864","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-25","epss":0.00292,"percentile":0.21519}],"risk":0.16644,"urls":["https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763761","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root.\n\nThe Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."},"relatedVulnerabilities":[{"id":"CVE-2026-32282","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.4,"impactScore":5.9,"exploitabilityScore":0.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32282","cwe":"CWE-59","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32282","date":"2026-10-25","epss":0.00292,"percentile":0.21519}],"urls":["https://go.dev/cl/763761","https://go.dev/issue/78293","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4864"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32282","description":"On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-46936","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46936"},"relatedVulnerabilities":[{"id":"CVE-2026-46936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46936","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46936","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46936","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60188","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60188","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60188"},"relatedVulnerabilities":[{"id":"CVE-2026-60188","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60188","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60188","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60188","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60189","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60189","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"risk":0.166,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60189"},"relatedVulnerabilities":[{"id":"CVE-2026-60189","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60189","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60189","date":"2026-10-25","epss":0.00332,"percentile":0.26116}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60189","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.24.11"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2025-4175","versionConstraint":"<1.24.11||>=1.25.0,<1.25.5 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2025-4175","fix":{"state":"fixed","versions":["1.24.11","1.25.5"],"available":[{"date":"2025-12-02","kind":"release","version":"1.24.11"},{"date":"2025-12-02","kind":"release","version":"1.25.5"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-25","epss":0.00284,"percentile":0.20687}],"risk":0.1633,"urls":["https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/723900","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."},"relatedVulnerabilities":[{"id":"CVE-2025-61727","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-61727","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-61727","date":"2026-10-25","epss":0.00284,"percentile":0.20687}],"urls":["https://go.dev/cl/723900","https://go.dev/issue/76442","https://groups.google.com/g/golang-announce/c/8FJoBkPddm4","https://pkg.go.dev/vuln/GO-2025-4175"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-61727","description":"An excluded subdomain constraint in a certificate chain does not restrict the usage of wildcard SANs in the leaf certificate. For example a constraint that excludes the subdomain test.example.com does not prevent a leaf certificate from claiming the SAN *.example.com."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-47023","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"risk":0.16149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47023"},"relatedVulnerabilities":[{"id":"CVE-2026-47023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47023","date":"2026-10-25","epss":0.00323,"percentile":0.25089}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47023","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4865","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4865","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-25","epss":0.0029,"percentile":0.21364}],"risk":0.16094999999999995,"urls":["https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763762","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied.\n\nThese issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."},"relatedVulnerabilities":[{"id":"CVE-2026-32289","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32289","cwe":"CWE-79","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32289","date":"2026-10-25","epss":0.0029,"percentile":0.21364}],"urls":["https://go.dev/cl/763762","https://go.dev/issue/78331","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4865"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32289","description":"Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6599","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6599","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"risk":0.160395,"urls":["https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/839866","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression.\n\nWe now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-94448","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-94448","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-94448","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"urls":["https://go.dev/cl/839866","https://go.dev/issue/81821","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6599"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-94448","description":"When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6600","versionConstraint":"<1.26.9||>=1.27.0-0,<1.27.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6600","fix":{"state":"fixed","versions":["1.26.9","1.27.2"],"available":[{"date":"2026-10-08","kind":"release","version":"1.26.9"},{"date":"2026-10-08","kind":"release","version":"1.27.2"}]},"cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"risk":0.160395,"urls":["https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/840925","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped.\n\nWe now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."},"relatedVulnerabilities":[{"id":"CVE-2026-97030","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"impactScore":2.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97030","cwe":"CWE-79","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-97030","date":"2026-10-25","epss":0.00289,"percentile":0.21233}],"urls":["https://go.dev/cl/840925","https://go.dev/issue/81823","https://groups.google.com/g/golang-announce/c/U2fTuyDJznI","https://pkg.go.dev/vuln/GO-2026-6600"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97030","description":"A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85985","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85985","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"risk":0.1585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85985"},"relatedVulnerabilities":[{"id":"CVE-2026-85985","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85985","cwe":"CWE-862","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-85985","date":"2026-10-25","epss":0.00317,"percentile":0.24399}],"urls":["https://github.com/MariaDB/server/commit/4f66ca1b69daf1b7e6a562ca8e86d77a6a70abfe","https://github.com/MariaDB/server/releases/tag/mariadb-10.11.19","https://github.com/MariaDB/server/releases/tag/mariadb-10.6.28","https://github.com/MariaDB/server/releases/tag/mariadb-11.4.13","https://github.com/MariaDB/server/releases/tag/mariadb-11.8.9","https://github.com/MariaDB/server/releases/tag/mariadb-12.3.3","https://github.com/MariaDB/server/releases/tag/mariadb-13.0.2","https://github.com/MariaDB/server/security/advisories/GHSA-2245-9hm3-wxf6","https://jira.mariadb.org/browse/MDEV-40323"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85985","description":"MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8674","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-8674","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"risk":0.1575,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8674"},"relatedVulnerabilities":[{"id":"CVE-2026-8674","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.3,"impactScore":3.6,"exploitabilityScore":1.7},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8674","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-8674","date":"2026-10-25","epss":0.00315,"percentile":0.2418}],"urls":["https://joshua.hu/fuzzing-glibc-libresolv","https://sourceware.org/bugzilla/show_bug.cgi?id=31026","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0021","https://sourceware.org/git/?p=glibc.git;a=commit;h=506ea57086bfb9ce3daff1c14246a1cb532aba0a","http://www.openwall.com/lists/oss-security/2026/09/17/4"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8674","description":"Initializing the DNS stub resolver from an /etc/resolv.conf file, or a LOCALDOMAIN environment variable, whose search list contains a domain of roughly 200 characters or more in the GNU C Library version 2.26 to 2.44 results in an assertion failure which aborts the process.\n\nThe resolver truncates the search list when copying it into the fixed-size _res.defdname buffer, then asserts that the copy is consistent with the full configuration.  The consistency check compared against the wrong size and did not handle a first entry that does not fit, so a correctly truncated list failed the assertion.  Any process that resolves names through the library is affected, including long-running processes that reload /etc/resolv.conf on the next query after it changes.  Search domains are commonly written to /etc/resolv.conf from data received over DHCP or from a VPN server, so an attacker on the local network may be able to trigger this without privileges on the target system, subject to validation by the network configuration software."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53792","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53792","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-25","epss":0.00311,"percentile":0.23684}],"risk":0.1555,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53792"},"relatedVulnerabilities":[{"id":"CVE-2026-53792","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.1},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53792","cwe":"CWE-129","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53792","cwe":"CWE-787","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53792","date":"2026-10-25","epss":0.00311,"percentile":0.23684}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-cg57-rp9g-56hw","https://www.vulncheck.com/advisories/rsync-out-of-bounds-read-via-zero-length-checksum-block"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53792","description":"rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.25.9"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-4869","versionConstraint":"<1.25.9||>=1.26.0-0,<1.26.2 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-4869","fix":{"state":"fixed","versions":["1.25.9","1.26.2"],"available":[{"date":"2026-04-07","kind":"release","version":"1.25.9"},{"date":"2026-04-07","kind":"release","version":"1.26.2"}]},"cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-25","epss":0.0029,"percentile":0.21362}],"risk":0.15225,"urls":["https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU"],"severity":"Medium","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/763766","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."},"relatedVulnerabilities":[{"id":"CVE-2026-32288","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-32288","cwe":"CWE-770","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-32288","date":"2026-10-25","epss":0.0029,"percentile":0.21362}],"urls":["https://go.dev/cl/763766","https://go.dev/issue/78301","https://groups.google.com/g/golang-announce/c/0uYbvbPZRWU","https://pkg.go.dev/vuln/GO-2026-4869"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-32288","description":"tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the \"old GNU sparse map\" format."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101625","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101625","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"risk":0.1515,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101625"},"relatedVulnerabilities":[{"id":"CVE-2026-101625","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101625","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101625","date":"2026-10-25","epss":0.00303,"percentile":0.22852}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101625","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Net).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized read access to a subset of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Confidentiality impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)."}]},{"artifact":{"id":"c5726b35636bdfbb","cpes":["cpe:2.3:a:golang:go:1.24.6:-:*:*:*:*:*:*"],"name":"stdlib","purl":"pkg:golang/stdlib@1.24.6","type":"go-module","version":"go1.24.6","language":"go","licenses":["BSD-3-Clause"],"metadata":{"architecture":"","goCompiledVersion":"go1.24.6"},"locations":[{"path":"/usr/local/bin/gosu","layerID":"sha256:970cfc96f7cb8606f5c5fb748772b0c93c94c7c98b67fef4733f881f136c6e39","accessPath":"/usr/local/bin/gosu","annotations":{"evidence":"primary"}}],"upstreams":[],"metadataType":"GolangBinMetadata"},"matchDetails":[{"fix":{"suggestedVersion":"1.26.10"},"type":"exact-direct-match","found":{"vulnerabilityID":"GO-2026-6809","versionConstraint":"<1.26.10||>=1.27.0-0,<1.27.3 (go)"},"matcher":"go-module-matcher","searchedBy":{"package":{"name":"stdlib","version":"go1.24.6"},"language":"go","namespace":"govulndb:language:go"}}],"vulnerability":{"id":"GO-2026-6809","fix":{"state":"fixed","versions":["1.26.10","1.27.3"],"available":[{"date":"2026-10-20","kind":"release","version":"1.26.10"},{"date":"2026-10-20","kind":"release","version":"1.27.3"}]},"cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-25","epss":0.00299,"percentile":0.22362}],"risk":0.1495,"urls":["https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek"],"severity":"Unknown","namespace":"govulndb:language:go","advisories":[],"dataSource":"https://go.dev/cl/851047","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action.\n\nTo defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."},"relatedVulnerabilities":[{"id":"CVE-2026-111943","cvss":[],"epss":[{"cve":"CVE-2026-111943","date":"2026-10-25","epss":0.00299,"percentile":0.22362}],"urls":["https://go.dev/cl/851047","https://go.dev/issue/82345","https://groups.google.com/g/golang-announce/c/66pojueaQek","https://pkg.go.dev/vuln/GO-2026-6809","http://www.openwall.com/lists/oss-security/2026/10/20/29"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-111943","description":"On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in crypto/x509 to return an error when calling Verify with any of the known intermediate certificates that are no longer considered to be trustworthy."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60190","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-60190","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60190"},"relatedVulnerabilities":[{"id":"CVE-2026-60190","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60190","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60190","date":"2026-10-25","epss":0.00297,"percentile":0.22153}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60190","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"a4c08556febfed08","cpes":["cpe:2.3:a:libtirpc-common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc-common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc_common:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc-common:1.3.7-0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtirpc:libtirpc_common:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc-common","purl":"pkg:deb/ubuntu/libtirpc-common@1.3.7-0.1?arch=all&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libtirpc-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc-common.list"}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-25","epss":0.00297,"percentile":0.22148}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-25","epss":0.00297,"percentile":0.22148}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"5280e800b6813f21","cpes":["cpe:2.3:a:libtirpc3t64:libtirpc3t64:1.3.7-0.1:*:*:*:*:*:*:*"],"name":"libtirpc3t64","purl":"pkg:deb/ubuntu/libtirpc3t64@1.3.7-0.1?arch=amd64&distro=ubuntu-26.04&upstream=libtirpc","type":"deb","version":"1.3.7-0.1","language":"","licenses":["BSD-3-Clause","GPL-2","LGPL-2.1"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtirpc3t64/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libtirpc3t64/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libtirpc3t64:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libtirpc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-85231","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libtirpc","version":"1.3.7-0.1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-85231","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-25","epss":0.00297,"percentile":0.22148}],"risk":0.1485,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-85231"},"relatedVulnerabilities":[{"id":"CVE-2026-85231","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-85231","cwe":"CWE-770","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-85231","date":"2026-10-25","epss":0.00297,"percentile":0.22148}],"urls":["https://access.redhat.com/security/cve/CVE-2026-85231","https://bugzilla.redhat.com/show_bug.cgi?id=2478512"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-85231","description":"A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate."}]},{"artifact":{"id":"9e17ab58e60d16b6","cpes":["cpe:2.3:a:libmariadb3:libmariadb3:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"libmariadb3","purl":"pkg:deb/ubuntu/libmariadb3@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libmariadb3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libmariadb3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libmariadb3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"e2ef141e5b6d91cf","cpes":["cpe:2.3:a:mariadb-backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_backup:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_backup:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-backup","purl":"pkg:deb/ubuntu/mariadb-backup@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-backup/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-backup/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-backup.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-backup.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"c88d144a97881b2f","cpes":["cpe:2.3:a:mariadb-client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client","purl":"pkg:deb/ubuntu/mariadb-client@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.list"},{"path":"/var/lib/dpkg/info/mariadb-client.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postinst"},{"path":"/var/lib/dpkg/info/mariadb-client.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"5fa40afe57679b3e","cpes":["cpe:2.3:a:mariadb-client-core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client-core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client_core:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_client:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-client-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_client_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-client-core","purl":"pkg:deb/ubuntu/mariadb-client-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-client-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-client-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-client-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-client-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"514029e6805409e6","cpes":["cpe:2.3:a:mariadb-common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_common:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-common","purl":"pkg:deb/ubuntu/mariadb-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.list"},{"path":"/var/lib/dpkg/info/mariadb-common.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postinst"},{"path":"/var/lib/dpkg/info/mariadb-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"57c2416d0e7e6155","cpes":["cpe:2.3:a:mariadb-server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server","purl":"pkg:deb/ubuntu/mariadb-server@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server.config","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.config"},{"path":"/var/lib/dpkg/info/mariadb-server.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.list"},{"path":"/var/lib/dpkg/info/mariadb-server.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postinst"},{"path":"/var/lib/dpkg/info/mariadb-server.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.postrm"},{"path":"/var/lib/dpkg/info/mariadb-server.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.preinst"},{"path":"/var/lib/dpkg/info/mariadb-server.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.prerm"},{"path":"/var/lib/dpkg/info/mariadb-server.templates","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.templates"},{"path":"/var/lib/dpkg/info/mariadb-server.triggers","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server.triggers"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"ae2606f09a5bb56f","cpes":["cpe:2.3:a:mariadb-server-core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_core:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_core:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-core","purl":"pkg:deb/ubuntu/mariadb-server-core@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-core/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-core/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-core.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-core.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"dd3fc4689680d806","cpes":["cpe:2.3:a:mariadb-server-galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server-galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server_galera:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb-server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb_server:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb-server-galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mariadb:mariadb_server_galera:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mariadb-server-galera","purl":"pkg:deb/ubuntu/mariadb-server-galera@1%3A13.0.2%2Bmaria~ubu2604?arch=amd64&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mariadb-server-galera/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mariadb-server-galera/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mariadb-server-galera.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mariadb-server-galera.list"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"521723603f11a31b","cpes":["cpe:2.3:a:mysql-common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql-common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql_common:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_common:1\\:13.0.2\\+maria\\~ubu2604:*:*:*:*:*:*:*"],"name":"mysql-common","purl":"pkg:deb/ubuntu/mysql-common@1%3A13.0.2%2Bmaria~ubu2604?arch=all&distro=ubuntu-26.04&upstream=mariadb","type":"deb","version":"1:13.0.2+maria~ubu2604","language":"","licenses":["sha256:2c6eb2ec4b682e43969f1db4da02bbaed33cc51f16b7170f990ae6d50271bf5b"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-common/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/mysql-common/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-common.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.list"},{"path":"/var/lib/dpkg/info/mysql-common.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/mysql-common.postrm"}],"upstreams":[{"name":"mariadb"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101677","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"mariadb","version":"1:13.0.2+maria~ubu2604"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-101677","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"risk":0.1475,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101677"},"relatedVulnerabilities":[{"id":"CVE-2026-101677","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","metrics":{"baseScore":4.3,"impactScore":1.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101677","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101677","date":"2026-10-25","epss":0.00295,"percentile":0.21919}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101677","description":"Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J).   The supported version that is affected is 26.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Connectors.  Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in  unauthorized update, insert or delete access to some of MySQL Connectors accessible data. CVSS 3.1 Base Score 4.3 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-25","epss":0.00294,"percentile":0.21796}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-25","epss":0.00294,"percentile":0.21796}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"024677f03ba4b41d","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89156","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-89156","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-25","epss":0.00294,"percentile":0.21796}],"risk":0.147,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89156"},"relatedVulnerabilities":[{"id":"CVE-2026-89156","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.9,"impactScore":1.5,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89156","cwe":"CWE-125","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89156","date":"2026-10-25","epss":0.00294,"percentile":0.21796}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-2p8c-ff85-vh9x"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89156","description":"PCRE2 before 10.48 has a pcre2_match out-of-bounds read after a JIT fallback when an attacker can provide invalid UTF data."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53801","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-25","epss":0.00286,"percentile":0.20916}],"risk":0.14300000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53801"},"relatedVulnerabilities":[{"id":"CVE-2026-53801","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53801","cwe":"CWE-59","type":"Secondary","source":"disclosure@vulncheck.com"},{"cve":"CVE-2026-53801","cwe":"CWE-367","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53801","date":"2026-10-25","epss":0.00286,"percentile":0.20916}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-mch3-qr4p-chgm","https://www.vulncheck.com/advisories/rsync-symlink-race-condition-directory-traversal"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53801","description":"rsync before 3.5.0 contains a symlink race condition vulnerability in the sender's directory scanning logic that allows attackers to cause the sender to enumerate and transfer files outside the module root's intended subtree. Attackers who can create or manipulate symlinks in a path component of the scanned tree can replace a symlink with a directory entry pointing outside the module root between the lstat() call and the subsequent opendir() call, exposing files beyond the intended root in both daemon-mode and non-daemon sender-side scanning."}]},{"artifact":{"id":"1ce77119307aa4a5","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c8481e5ece0d4908","cpes":["cpe:2.3:a:libc-gconv-modules-extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules-extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules_extra:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv-modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv_modules:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc-gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc_gconv:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-gconv-modules-extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_gconv_modules_extra:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc-gconv-modules-extra","purl":"pkg:deb/ubuntu/libc-gconv-modules-extra@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-gconv-modules-extra/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc-gconv-modules-extra/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc-gconv-modules-extra:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"c513001c6e67b66e","cpes":["cpe:2.3:a:libc6:libc6:2.43-2ubuntu2.4:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.43-2ubuntu2.4?arch=amd64&distro=ubuntu-26.04&upstream=glibc","type":"deb","version":"2.43-2ubuntu2.4","language":"","licenses":["BSD-2-clause","BSD-3-clause-Berkeley","BSD-3-clause-Carnegie","BSD-3-clause-Oracle","BSD-3-clause-WIDE","BSD-like-Spencer","BSL-1.0","CORE-MATH","Carnegie","DEC","FSFAP","GFDL-1.3","GPL-2","GPL-2+","GPL-2+-with-link-exception","GPL-3","GPL-3+","IBM","ISC","Inner-Net","LGPL-2","LGPL-2+","LGPL-2.1","LGPL-2.1+","LGPL-2.1+-with-link-exception","LGPL-3","LGPL-3+","MIT-like-Lord","PCRE","SunPro","Unicode-DFS-2016","Univ-Coimbra","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-97399","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"glibc","version":"2.43-2ubuntu2.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-97399","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"risk":0.1405,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-97399"},"relatedVulnerabilities":[{"id":"CVE-2026-97399","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-97399","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-97399","date":"2026-10-25","epss":0.00281,"percentile":0.20388}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34683","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0024","http://www.openwall.com/lists/oss-security/2026/09/28/7"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-97399","description":"The strncasecmp function in the GNU C Library 2.24 and later optimized for the Power8 architecture may read one byte beyond the input size limit, which may crash a program when that byte is not readable.\n\nThis condition may happen when the input strings to the strncasecmp function are attacker controlled in an application and they match all the way up to the edge of their page and the neighbouring page is either not mapped or is not readable."}]},{"artifact":{"id":"b5d6877111b25910","cpes":["cpe:2.3:a:libdbi-perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi-perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi_perl:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi-perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*","cpe:2.3:a:libdbi:libdbi_perl:1.647-1ubuntu0.26.04.4:*:*:*:*:*:*:*"],"name":"libdbi-perl","purl":"pkg:deb/ubuntu/libdbi-perl@1.647-1ubuntu0.26.04.4?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"1.647-1ubuntu0.26.04.4","language":"","licenses":["Artistic","GPL-1","GPL-1+"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libdbi-perl/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libdbi-perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libdbi-perl:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-108518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"libdbi-perl","version":"1.647-1ubuntu0.26.04.4"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-108518","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-108518","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-108518","date":"2026-10-25","epss":0.00275,"percentile":0.19759}],"risk":0.13749999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-108518"},"relatedVulnerabilities":[{"id":"CVE-2026-108518","cvss":[],"cwes":[{"cve":"CVE-2026-108518","cwe":"CWE-843","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-108518","date":"2026-10-25","epss":0.00275,"percentile":0.19759}],"urls":["https://github.com/perl5-dbi/dbi/commit/c2ff4df575d7af625bb4d0d1ef7539f90b22d8b2.patch","https://github.com/perl5-dbi/dbi/security/advisories/GHSA-7393-6f8r-fhh3","https://metacpan.org/release/HMBRAND/DBI-1.656/changes","http://www.openwall.com/lists/oss-security/2026/10/20/37"],"severity":"Unknown","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-108518","description":"DBI versions before 1.656 for Perl crash via type confusion in dbi_profile when a database handle is destroyed under a Profile Path with an {attr} element.\n\nAn {attr} element names a database handle attribute, which dbi_profile reads from the handle's inner hash. It expects the inner handle as a reference and dereferences it, but a handle that is being destroyed hands back the inner hash itself, so the dereference yields the hash's bucket array. A type check on that pointer usually fails and the call goes unprofiled. When the memory it addresses passes the check, the attribute lookup dereferences a NULL or invalid pointer and the process dies on SIGSEGV.\n\nThe Path is set by the application, by the Profile handle attribute, or by the DBI_PROFILE environment variable, so `DBI_PROFILE={ImplementorClass}` can crash an unmodified program."}]},{"artifact":{"id":"c67c911d2c6bf76f","cpes":["cpe:2.3:a:rsync:rsync:3.4.1\\+ds1-7ubuntu0.3:*:*:*:*:*:*:*"],"name":"rsync","purl":"pkg:deb/ubuntu/rsync@3.4.1%2Bds1-7ubuntu0.3?arch=amd64&distro=ubuntu-26.04","type":"deb","version":"3.4.1+ds1-7ubuntu0.3","language":"","licenses":["FSF-unlimited","FSFULLR","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","PostgreSQL","public-domain","snprintf"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/rsync/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/rsync/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.conffiles","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/rsync.list","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.list"},{"path":"/var/lib/dpkg/info/rsync.postinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postinst"},{"path":"/var/lib/dpkg/info/rsync.postrm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.postrm"},{"path":"/var/lib/dpkg/info/rsync.preinst","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.preinst"},{"path":"/var/lib/dpkg/info/rsync.prerm","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/rsync.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-53788","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"rsync","version":"3.4.1+ds1-7ubuntu0.3"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-53788","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-25","epss":0.00272,"percentile":0.19353}],"risk":0.136,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-53788"},"relatedVulnerabilities":[{"id":"CVE-2026-53788","cvss":[{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}},{"type":"Secondary","source":"disclosure@vulncheck.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-53788","cwe":"CWE-93","type":"Secondary","source":"disclosure@vulncheck.com"}],"epss":[{"cve":"CVE-2026-53788","date":"2026-10-25","epss":0.00272,"percentile":0.19353}],"urls":["https://github.com/RsyncProject/rsync/releases/tag/v3.5.0","https://github.com/RsyncProject/rsync/security/advisories/GHSA-p4c5-8c68-5fjq","https://www.vulncheck.com/advisories/rsync-newline-injection-via-name-converter-uid-gid-mapping"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-53788","description":"rsync before 3.5.0 contains a newline injection vulnerability in the name-converter uid/gid mapping interface that allows local attackers to forge protocol messages by creating user or group names containing newline characters. Attackers can inject malicious newline characters into names communicated over the pipe-based line-oriented protocol to cause the rsync daemon to process attacker-influenced data as legitimate protocol input, corrupting uid/gid mapping logic."}]},{"artifact":{"id":"2ab9a02662b35ad1","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:5cac300e390e2fd748b258618f403b7813229929ad6de903b0c52a210a930824","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-25","epss":0.00269,"percentile":0.18838}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-25","epss":0.00269,"percentile":0.18838}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]},{"artifact":{"id":"024677f03ba4b41d","cpes":["cpe:2.3:a:libpcre2-posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_posix3:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-posix3:10.46-1build1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_posix3:10.46-1build1:*:*:*:*:*:*:*"],"name":"libpcre2-posix3","purl":"pkg:deb/ubuntu/libpcre2-posix3@10.46-1build1?arch=amd64&distro=ubuntu-26.04&upstream=pcre2","type":"deb","version":"10.46-1build1","language":"","licenses":["BSD-2-clause","BSD-3-clause","BSD-3-clause-Cambridge","X11","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-posix3/copyright","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/usr/share/doc/libpcre2-posix3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","layerID":"sha256:4b9ad192fcc501f352dd4b89fabc3d17226d00a9af45ee5def3a9dae386db025","accessPath":"/var/lib/dpkg/info/libpcre2-posix3:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-103111","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"26.04"},"package":{"name":"pcre2","version":"10.46-1build1"},"namespace":"ubuntu:distro:ubuntu:26.04"}}],"vulnerability":{"id":"CVE-2026-103111","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-25","epss":0.00269,"percentile":0.18838}],"risk":0.1345,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:26.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-103111"},"relatedVulnerabilities":[{"id":"CVE-2026-103111","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"impactScore":4.8,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-103111","cwe":"CWE-787","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-103111","date":"2026-10-25","epss":0.00269,"percentile":0.18838}],"urls":["https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-r9hj-j2rw-4q3m","https://lists.debian.org/debian-lts-announce/2026/10/msg00008.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-103111","description":"PCRE2 before 10.49, when there is an attacker-controlled regular expression and certain JIT API usage, allows an out-of-bounds write with arbitrary data."}]}],"grade":"F","score":"0.00","as_of":"2026-10-27T04:46:05.390Z","grype_db_version":"2026-10-26T06:38:44.000Z"}