{"grype_matches":[{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-12","epss":0.04002,"percentile":0.9068}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-12","epss":0.04002,"percentile":0.9068}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-45447","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-45447","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-12","epss":0.04002,"percentile":0.9068}],"risk":3.0015,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-45447"},"relatedVulnerabilities":[{"id":"CVE-2026-45447","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-45447","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2026-45447","cwe":"CWE-825","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-45447","date":"2026-11-12","epss":0.04002,"percentile":0.9068}],"urls":["https://github.com/openssl/openssl/commit/3aad5eb7af4de4ee0633c30a8541a54d9bbde63c","https://github.com/openssl/openssl/commit/7d4a980c62258c5910cc883936e0c8dbab4d75a8","https://github.com/openssl/openssl/commit/9dfd688ad2290fc5075cacbc9bf0c9a93eefed54","https://github.com/openssl/openssl/commit/a541ae8bfe849a30cc885e8780715c0f488e496c","https://github.com/openssl/openssl/commit/c505d7559da5d5f9f2c3913c6883a5562ce7273e","https://openssl-library.org/news/secadv/20260609.txt","https://access.redhat.com/errata/RHSA-2026:25237","https://access.redhat.com/errata/RHSA-2026:25239","https://access.redhat.com/errata/RHSA-2026:26275","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:34102","https://access.redhat.com/errata/RHSA-2026:35869","https://access.redhat.com/errata/RHSA-2026:36215","https://access.redhat.com/errata/RHSA-2026:36217","https://access.redhat.com/errata/RHSA-2026:39009","https://access.redhat.com/errata/RHSA-2026:39012","https://access.redhat.com/errata/RHSA-2026:39981","https://access.redhat.com/errata/RHSA-2026:44438","https://access.redhat.com/errata/RHSA-2026:47735","https://access.redhat.com/errata/RHSA-2026:47737","https://access.redhat.com/errata/RHSA-2026:58563","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:66524","https://access.redhat.com/security/cve/CVE-2026-45447","https://bugzilla.redhat.com/show_bug.cgi?id=2481898","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45447.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-45447","description":"Issue summary: A specially crafted PKCS#7 or S/MIME signed message could\ntrigger a use-after-free during PKCS#7 signature verification.\n\nImpact summary: A use-after-free may result in process crashes, heap\ncorruption, or potentially remote code execution.\n\nWhen processing a PKCS#7 or S/MIME signed message, if the SignedData\ndigestAlgorithms field is present as an empty ASN.1 SET, OpenSSL may\nincorrectly free a caller-owned BIO during PKCS7_verify(). A subsequent\nuse of the BIO by the calling application results in a use-after-free\ncondition.\n\nIn the common case this occurs when the application later calls\nBIO_free() on the BIO originally passed to PKCS7_verify(). Depending\non allocator behavior and application-specific BIO usage patterns, this\nmay result in a crash or other memory corruption. In some application\ncontexts this may potentially be exploitable for remote code execution.\n\nApplications that process PKCS#7 or S/MIME signed messages using OpenSSL\nPKCS#7 APIs may be affected. Applications using the CMS APIs for this\nprocessing are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-11-12","epss":0.03522,"percentile":0.89397}],"risk":1.0566,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33574"},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-11-12","epss":0.03522,"percentile":0.89397}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-831302.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2021-33574","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-33574","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-11-12","epss":0.03522,"percentile":0.89397}],"risk":1.0566,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-33574"},"relatedVulnerabilities":[{"id":"CVE-2021-33574","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-33574","cwe":"CWE-416","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2021-33574","date":"2026-11-12","epss":0.03522,"percentile":0.89397}],"urls":["https://lists.debian.org/debian-lts-announce/2022/10/msg00021.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJYYIMDDYOHTP2PORLABTOHYQYYREZDD/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RBUUWUGXVILQXVWEOU7N42ICHPJNAEUP/","https://security.gentoo.org/glsa/202107-07","https://security.netapp.com/advisory/ntap-20210629-0005/","https://sourceware.org/bugzilla/show_bug.cgi?id=27896","https://sourceware.org/bugzilla/show_bug.cgi?id=27896#c1","https://cert-portal.siemens.com/productcert/html/ssa-398330.html","https://cert-portal.siemens.com/productcert/html/ssa-831302.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-33574","description":"The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes object (passed through its struct sigevent parameter) after it has been freed by the caller, leading to a denial of service (application crash) or possibly unspecified other impact."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33845","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33845","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-12","epss":0.02073,"percentile":0.81735}],"risk":1.0365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33845"},"relatedVulnerabilities":[{"id":"CVE-2026-33845","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33845","cwe":"CWE-191","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33845","date":"2026-11-12","epss":0.02073,"percentile":0.81735}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33845","https://bugzilla.redhat.com/show_bug.cgi?id=2450624","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33845.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33845","description":"A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and resulting in an out-of-bounds read. This issue is remotely exploitable and may cause information disclosure or denial of service."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63382","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-12","epss":0.01991,"percentile":0.80953}],"risk":0.9955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63382"},"relatedVulnerabilities":[{"id":"CVE-2026-63382","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-12","epss":0.01991,"percentile":0.80953}],"urls":["https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63382","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63382","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63382","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-12","epss":0.01991,"percentile":0.80953}],"risk":0.9955,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63382"},"relatedVulnerabilities":[{"id":"CVE-2026-63382","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63382","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63382","date":"2026-11-12","epss":0.01991,"percentile":0.80953}],"urls":["https://github.com/libevent/libevent/commit/10abb34b8dc3e1184de315dd261ce4b77563cda6","https://github.com/libevent/libevent/commit/5119ceb00557bf007f9065709e852686f3c0bb6e","https://github.com/libevent/libevent/commit/83ba67373032334559b82409db035dd8c3cc1660","https://github.com/libevent/libevent/commit/ac38703b2d312200c4f967f02936af0118d384a0","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-q39v-w2g7-gr8j"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63382","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, the libevent evhttp parser in http.c inconsistently handles duplicate Transfer-Encoding headers, comma-separated Transfer-Encoding values, and bare line feeds in chunked framing. evhttp_find_header can select only the first header, evhttp_check_transfer_encoding_ was absent so the previous whole-string comparison fails to recognize valid lists ending in chunked, and evhttp_handle_chunked_read uses EVBUFFER_EOL_CRLF rather than EVBUFFER_EOL_CRLF_STRICT, accepting bare LF chunk terminators. When libevent is deployed behind a proxy that frames the same request differently, an unauthenticated remote attacker can desynchronize request boundaries and smuggle a second request, potentially bypassing access controls or poisoning caches. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.9746999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010022"},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010022","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"risk":0.9746999999999999,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010022"},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"impactScore":6.5,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010022","date":"2026-11-12","epss":0.03249,"percentile":0.88507}],"urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.966,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010024"},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010024","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"risk":0.966,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010024"},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2019-1010024","date":"2026-11-12","epss":0.0322,"percentile":0.88401}],"urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.9207,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010023"},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2019-1010023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"risk":0.9207,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2019-1010023"},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"impactScore":6.5,"exploitabilityScore":8.6},"version":"2.0","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"impactScore":2.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","date":"2026-11-12","epss":0.03069,"percentile":0.87825}],"urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&amp%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-12","epss":0.01781,"percentile":0.78577}],"risk":0.8905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-12","epss":0.01781,"percentile":0.78577}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-9230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-12","epss":0.01781,"percentile":0.78577}],"risk":0.8905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-9230"},"relatedVulnerabilities":[{"id":"CVE-2025-9230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"},{"cve":"CVE-2025-9230","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-9230","date":"2026-11-12","epss":0.01781,"percentile":0.78577}],"urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html","https://cert-portal.siemens.com/productcert/html/ssa-089022.html","https://cert-portal.siemens.com/productcert/html/ssa-253495.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html","https://cert-portal.siemens.com/productcert/html/ssa-485750.html","https://cert-portal.siemens.com/productcert/html/ssa-585531.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-31486","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-31486","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"risk":0.8710000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-31486"},"relatedVulnerabilities":[{"id":"CVE-2023-31486","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2023-31486","cwe":"CWE-295","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-31486","date":"2026-11-12","epss":0.01742,"percentile":0.78082}],"urls":["http://www.openwall.com/lists/oss-security/2023/04/29/1","http://www.openwall.com/lists/oss-security/2023/05/03/3","http://www.openwall.com/lists/oss-security/2023/05/03/5","http://www.openwall.com/lists/oss-security/2023/05/07/2","https://blog.hackeriet.no/perl-http-tiny-insecure-tls-default-affects-cpan-modules/","https://github.com/chansen/p5-http-tiny/pull/153","https://hackeriet.github.io/cpan-http-tiny-overview/","https://www.openwall.com/lists/oss-security/2023/04/18/14","https://www.openwall.com/lists/oss-security/2023/05/03/4","https://www.reddit.com/r/perl/comments/111tadi/psa_httptiny_disabled_ssl_verification_by_default/","https://security.netapp.com/advisory/ntap-20241129-0011/"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-31486","description":"HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where users must opt in to verify certificates."}]},{"artifact":{"id":"99b6ce94877a50b1","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.16.0-2ubuntu0.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"4.16.0-2ubuntu0.1","language":"","licenses":["sha256:ab2f3532a1bf45d90643e92c1dfb985982698ecbf63f12595acfd9598d36350d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2021-46848","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libtasn1-6","version":"4.16.0-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2021-46848","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-12","epss":0.02843,"percentile":0.86873}],"risk":0.8529,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2021-46848"},"relatedVulnerabilities":[{"id":"CVE-2021-46848","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Primary","source":"nvd@nist.gov"},{"cve":"CVE-2021-46848","cwe":"CWE-193","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2021-46848","date":"2026-11-12","epss":0.02843,"percentile":0.86873}],"urls":["https://bugs.gentoo.org/866237","https://gitlab.com/gnutls/libtasn1/-/commit/44a700d2051a666235748970c2df047ff207aeb5","https://gitlab.com/gnutls/libtasn1/-/issues/32","https://lists.debian.org/debian-lts-announce/2023/01/msg00003.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AV4SHDJF2XLB4CUPTBPQQ6CLGZ5LKXPZ/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ECM2ELTVRYV4BZ5L5GMIRQE27RFHPAQ6/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OGO7XST4EIJGX4B2ITZCYSWM24534BSU/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V5LWOGF7QRMNFRUCZY6TDYQJVFI6MOQ2/","https://security.netapp.com/advisory/ntap-20221118-0006/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-46848","description":"GNU Libtasn1 before 4.19.0 has an ETYPE_OK off-by-one array size check that affects asn1_encode_simple_der."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32988","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-32988","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-12","epss":0.01475,"percentile":0.742}],"risk":0.7374999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32988"},"relatedVulnerabilities":[{"id":"CVE-2025-32988","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32988","cwe":"CWE-415","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32988","date":"2026-11-12","epss":0.01475,"percentile":0.742}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32988","https://bugzilla.redhat.com/show_bug.cgi?id=2359622","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32988","description":"A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.\n\nThis vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior."}]},{"artifact":{"id":"30dc48158f69793c","cpes":["cpe:2.3:a:apt:apt:2.0.11:*:*:*:*:*:*:*"],"name":"apt","purl":"pkg:deb/ubuntu/apt@2.0.11?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"2.0.11","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/apt/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/apt/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/apt.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.list"},{"path":"/var/lib/dpkg/info/apt.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.postinst"},{"path":"/var/lib/dpkg/info/apt.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.postrm"},{"path":"/var/lib/dpkg/info/apt.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.preinst"},{"path":"/var/lib/dpkg/info/apt.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.prerm"},{"path":"/var/lib/dpkg/info/apt.shlibs","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.shlibs"},{"path":"/var/lib/dpkg/info/apt.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/apt.triggers"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"apt","version":"2.0.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"6cd5f7b56cd12dd1","cpes":["cpe:2.3:a:libapt-pkg6.0:libapt-pkg6.0:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:libapt-pkg6.0:libapt_pkg6.0:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg6.0:libapt-pkg6.0:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:libapt_pkg6.0:libapt_pkg6.0:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt-pkg6.0:2.0.11:*:*:*:*:*:*:*","cpe:2.3:a:libapt:libapt_pkg6.0:2.0.11:*:*:*:*:*:*:*"],"name":"libapt-pkg6.0","purl":"pkg:deb/ubuntu/libapt-pkg6.0@2.0.11?arch=amd64&distro=ubuntu-20.04&upstream=apt","type":"deb","version":"2.0.11","language":"","licenses":["GPL-2.0-or-later"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libapt-pkg6.0/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libapt-pkg6.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libapt-pkg6.0:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libapt-pkg6.0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"apt"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-109518","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"apt","version":"2.0.11"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-109518","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"risk":0.696,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-109518"},"relatedVulnerabilities":[{"id":"CVE-2026-109518","cvss":[{"type":"Secondary","source":"security@ubuntu.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-109518","cwe":"CWE-62","type":"Secondary","source":"security@ubuntu.com"},{"cve":"CVE-2026-109518","cwe":"CWE-367","type":"Secondary","source":"security@ubuntu.com"}],"epss":[{"cve":"CVE-2026-109518","date":"2026-11-12","epss":0.00928,"percentile":0.61031}],"urls":["https://lists.debian.org/debian-security-announce/2026/msg00526.html","https://ubuntu.com/security/notices/USN-8996-1","http://www.openwall.com/lists/oss-security/2026/11/04/12","https://lists.debian.org/debian-lts-announce/2026/11/msg00004.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-109518","description":"On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic (including a malicious mirror or proxy) between an APT client and an archive server triggered by a package install can trick the client into installing an attacker-controlled unverified package and achieve remote code execution with root privileges.\n\n\n\nThe vulnerability is caused by the reuse of hard links and requires the client to follow redirects and retry the download of package files. It requires the client to have a non-zero Acquire::Retries configuration setting; the value 3 is the default starting with Debian 12 (bookworm) and Ubuntu 22.04 LTS (Jammy Jellyfish), so older releases are unaffected in a default configuration"}]},{"artifact":{"id":"99b6ce94877a50b1","cpes":["cpe:2.3:a:libtasn1-6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1-6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1_6:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1-6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libtasn1:libtasn1_6:4.16.0-2ubuntu0.1:*:*:*:*:*:*:*"],"name":"libtasn1-6","purl":"pkg:deb/ubuntu/libtasn1-6@4.16.0-2ubuntu0.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"4.16.0-2ubuntu0.1","language":"","licenses":["sha256:ab2f3532a1bf45d90643e92c1dfb985982698ecbf63f12595acfd9598d36350d"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtasn1-6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtasn1-6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtasn1-6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-13151","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libtasn1-6","version":"4.16.0-2ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-13151","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-12","epss":0.0137,"percentile":0.72304}],"risk":0.685,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-13151"},"relatedVulnerabilities":[{"id":"CVE-2025-13151","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-13151","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2025-13151","date":"2026-11-12","epss":0.0137,"percentile":0.72304}],"urls":["https://gitlab.com/gnutls/libtasn1","https://gitlab.com/gnutls/libtasn1/-/merge_requests/121","http://www.openwall.com/lists/oss-security/2026/01/08/5","https://www.kb.cert.org/vuls/id/271649"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13151","description":"Stack-based buffer overflow in libtasn1 version: v4.20.0. The function fails to validate the size of input data resulting in a buffer overflow in asn1_expend_octet_string."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-12","epss":0.00906,"percentile":0.60328}],"risk":0.6795000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-12","epss":0.00906,"percentile":0.60328}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-84782","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-84782","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-12","epss":0.00906,"percentile":0.60328}],"risk":0.6795000000000001,"urls":[],"severity":"High","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-84782"},"relatedVulnerabilities":[{"id":"CVE-2026-84782","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-84782","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-84782","date":"2026-11-12","epss":0.00906,"percentile":0.60328}],"urls":["https://github.com/openssl/openssl/commit/906cf0ef1c85ca40ce69163e9086d6d3fe292943","https://github.com/openssl/openssl/commit/9f6b34422af7eb5dac61322e33dac1ae989fa628","https://github.com/openssl/openssl/commit/a383dafdd754eb5b22bf45e37e1bff9d07277a58","https://github.com/openssl/openssl/commit/d951e02ede8f6a6ff8150546db44b34f0518192c","https://openssl-library.org/news/secadv/20260929.txt","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-84782","description":"Issue summary: The DTLS retransmission logic does not correctly handle\na handshake message write that is suspended part-way through.\nThe retransmitted message can be read past the message buffer and\nthe retransmission overwrites the internal state the suspended write\nneeds to resume correctly.\n\nImpact summary: The retransmitted message can disclose a heap memory\nto the peer as plaintext handshake data or cause a crash and a Denial\nof Service when the read reaches an unmapped memory region.\n\nCWE: CWE-125: Out-of-bounds Read\n\nDescription: DTLS handshake messages can be written out in multiple\nfragments, and a write can suspend mid-message (returning WANT_WRITE)\nif the underlying transport temporarily cannot accept more data. While\nsuch a write is suspended, the DTLS retransmission timer may\nindependently fire and ask the retransmission logic to resend an\nearlier, already-acknowledged-as-sent message from its retransmit\nqueue.\n\nThe retransmission logic reused the same internal buffer and position\ntracking as the message that was still being written, without\nresetting the position back to the start of the message being\nretransmitted. As a result the retransmission was read starting from\nwherever the suspended write had left off, producing a mislabelled\nmessage whose body was leftover bytes from the other, larger message\nstill in flight - content that was never meant to be sent at that\npoint, and which could run past the end of the allocated buffer.\n\nSeparately, even when the retransmission is positioned correctly,\nallowing it to run to completion while another write is suspended\noverwrites the same shared bookkeeping that the suspended write\ndepends on to resume. When the application later resumes the\nsuspended write (via a subsequent SSL_read(), SSL_write(),\nSSL_accept(), or SSL_connect() call), it finds that bookkeeping in a\nstate inconsistent with the message and aborts the process in\na debugging build.\n\nThe fix resets the retransmission's read position to the start of the\nmessage before resending, and skips retransmission entirely whenever a\nhandshake write is still suspended, deferring to the next call that\nresumes it instead.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42009","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42009","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-12","epss":0.01335,"percentile":0.71584}],"risk":0.6675,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42009"},"relatedVulnerabilities":[{"id":"CVE-2026-42009","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42009","cwe":"CWE-475","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42009","date":"2026-11-12","epss":0.01335,"percentile":0.71584}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:29794","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42009","https://bugzilla.redhat.com/show_bug.cgi?id=2467279","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-2","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42009.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42009","description":"A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-12","epss":0.01292,"percentile":0.70683}],"risk":0.6459999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63385"},"relatedVulnerabilities":[{"id":"CVE-2026-63385","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-12","epss":0.01292,"percentile":0.70683}],"urls":["https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63385","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63385","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63385","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-12","epss":0.01292,"percentile":0.70683}],"risk":0.6459999999999999,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63385"},"relatedVulnerabilities":[{"id":"CVE-2026-63385","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":9.2},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63385","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63385","date":"2026-11-12","epss":0.01292,"percentile":0.70683}],"urls":["https://github.com/libevent/libevent/commit/758be0c0f69c1934ef9a84ab39e9f9e5fde2e6d0","https://github.com/libevent/libevent/commit/9170dd35e64714613e8d13b290587cfc28e258e2","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-jcwh-pvf2-73p2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63385","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttp_decode_uri_internal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass validation performed on a different representation. evhttp_header_is_valid_value also accepts obsolete line folding in header values containing carriage return or line feed characters, allowing a proxy and libevent to interpret headers differently and enabling header injection or access control bypass. The CRLF header acceptance is fixed in versions 2.1.13 and 2.2.2-alpha, but the reviewed patches do not clearly remediate the URI NUL-truncation condition."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-12","epss":0.01277,"percentile":0.70375}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-12","epss":0.01277,"percentile":0.70375}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-4598","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-4598","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-12","epss":0.01277,"percentile":0.70375}],"risk":0.6385,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-4598"},"relatedVulnerabilities":[{"id":"CVE-2025-4598","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":4.7,"impactScore":3.6,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-4598","cwe":"CWE-364","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-4598","date":"2026-11-12","epss":0.01277,"percentile":0.70375}],"urls":["https://access.redhat.com/errata/RHSA-2025:22660","https://access.redhat.com/errata/RHSA-2025:22868","https://access.redhat.com/errata/RHSA-2025:23227","https://access.redhat.com/errata/RHSA-2025:23234","https://access.redhat.com/errata/RHSA-2026:0414","https://access.redhat.com/errata/RHSA-2026:1652","https://access.redhat.com/errata/RHSA-2026:18153","https://access.redhat.com/security/cve/CVE-2025-4598","https://bugzilla.redhat.com/show_bug.cgi?id=2369242","https://www.openwall.com/lists/oss-security/2025/05/29/3","http://seclists.org/fulldisclosure/2025/Jun/9","http://www.openwall.com/lists/oss-security/2025/06/05/1","http://www.openwall.com/lists/oss-security/2025/06/05/3","http://www.openwall.com/lists/oss-security/2025/08/18/3","https://blogs.oracle.com/linux/post/analysis-of-cve-2025-4598","https://ciq.com/blog/the-real-danger-of-systemd-coredump-cve-2025-4598/","https://lists.debian.org/debian-lts-announce/2025/07/msg00022.html","https://www.openwall.com/lists/oss-security/2025/08/18/3","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4598","description":"A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.\n\nA SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-33846","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-33846","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-12","epss":0.01263,"percentile":0.70108}],"risk":0.6315000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-33846"},"relatedVulnerabilities":[{"id":"CVE-2026-33846","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-33846","cwe":"CWE-130","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-33846","date":"2026-11-12","epss":0.01263,"percentile":0.70108}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34372","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56786","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:56911","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-33846","https://bugzilla.redhat.com/show_bug.cgi?id=2450625","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33846.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-33846","description":"A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incoming handshake fragments are matched and merged based solely on handshake type, without validating that the message_length field remains consistent across all fragments of the same logical message. An attacker can exploit this by sending crafted DTLS fragments with conflicting message_length values, causing the implementation to allocate a buffer based on a smaller initial fragment and subsequently write beyond its bounds using larger, inconsistent fragments. Because the merge operation does not enforce proper bounds checking against the allocated buffer size, this results in an out-of-bounds write on the heap. The vulnerability is remotely exploitable without authentication via the DTLS handshake path and can lead to application crashes or potential memory corruption."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-12","epss":0.0105,"percentile":0.64741}],"risk":0.525,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42010"},"relatedVulnerabilities":[{"id":"CVE-2026-42010","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2026-42010","cwe":"CWE-626","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-42010","cwe":"CWE-170","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42010","date":"2026-11-12","epss":0.0105,"percentile":0.64741}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:34764","https://access.redhat.com/errata/RHSA-2026:34788","https://access.redhat.com/errata/RHSA-2026:34790","https://access.redhat.com/errata/RHSA-2026:36004","https://access.redhat.com/errata/RHSA-2026:36005","https://access.redhat.com/errata/RHSA-2026:36006","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42010","https://bugzilla.redhat.com/show_bug.cgi?id=2467289","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-4","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42010.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42010","description":"A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-12","epss":0.00916,"percentile":0.60681}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-12","epss":0.00916,"percentile":0.60681}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-63072","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63072","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-12","epss":0.00916,"percentile":0.60681}],"risk":0.45799999999999996,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63072"},"relatedVulnerabilities":[{"id":"CVE-2026-63072","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63072","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-63072","date":"2026-11-12","epss":0.00916,"percentile":0.60681}],"urls":["https://github.com/openssl/openssl/commit/2a3dac874c8057c1f0186849bf1ede1ae7b6b756","https://github.com/openssl/openssl/commit/87784ad619af36b8807c2044b3940006fccc1e42","https://github.com/openssl/openssl/commit/9530a5fd1aacaeccdced4478ea2340a480613335","https://github.com/openssl/openssl/commit/9ec2f6d2ae2bcad907cf7ee38584855bafe4979a","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63072","description":"Issue summary: OpenSSL CMS decryption sizes the key-unwrap output buffer based\non querying the unwrapped key size, but the AES-WRAP-PAD unwrap primitive\ncan write and cleanse more bytes than that query reports, causing an 8-byte\nout-of-bounds heap write.\n\nImpact summary: An attacker who supplies a crafted CMS message can trigger a\ndeterministic 8-byte out-of-bounds heap write when the victim decrypts it\nwith CMS_decrypt(), corrupting the heap and typically resulting in a Denial\nof Service.\n\nCWE: CWE-787: Out-of-bounds Write\n\nDescription: The key-wrap OID is potentially attacker-controlled on the wire.\nCMS unwrapping allows both id-aesNNN-wrap-pad and id-aesNNN-wrap ciphers.\nAn attacker can take a legitimate message and change a single OID byte to\nselect the padded variant while leaving the message otherwise valid. Since\nthe unwrap key is derived from the recipient's private operation (ECDH key\nagreement or ML-KEM decapsulation), the RFC 5649 integrity check cannot\npass, and the decryption fails with integrity failure.\n\nThe write is a fixed-size (8-byte), fixed-value (zero) heap overflow\nimmediately past the allocation, requires no special configuration, and is\nreachable from the public CMS_decrypt() function. The consequence is\na heap corruption leading to a Denial of Service. The fix in the CMS code\nsizes the unwrap output buffer for the worst case so a failed unwrap cannot\nwrite past the allocation.\n\nFIPS impact: no\n\nAs the CMS code lives outside the FIPS module boundary, no FIPS\nmodules are affected by this CVE."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-32990","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-32990","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-12","epss":0.00896,"percentile":0.6003}],"risk":0.44799999999999995,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-32990"},"relatedVulnerabilities":[{"id":"CVE-2025-32990","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-32990","cwe":"CWE-122","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-32990","date":"2026-11-12","epss":0.00896,"percentile":0.6003}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/security/cve/CVE-2025-32990","https://bugzilla.redhat.com/show_bug.cgi?id=2359620","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-32990","description":"A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2011-10043","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2011-10043","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"risk":0.3875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2011-10043"},"relatedVulnerabilities":[{"id":"CVE-2011-10043","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2011-10043","cwe":"CWE-145","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2011-10043","date":"2026-11-12","epss":0.00775,"percentile":0.56264}],"urls":["https://blogs.perl.org/users/michael_g_schwern/2011/10/how-not-to-load-a-module-or-bad-interfaces-make-good-people-do-bad-things.html","https://metacpan.org/release/BINGOS/Module-Load-0.22/changes","https://metacpan.org/release/BINGOS/Module-Load-0.22/diff/BINGOS/Module-Load-0.20/lib/Module/Load.pm"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2011-10043","description":"Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded.\n\nModule names starting with \"::\" could be passed to the load function to specify arbitrary module paths.\n\nAttackers able to influence module names passed to load could use that bug to execute arbitrary code."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6395","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6395","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-12","epss":0.00771,"percentile":0.56141}],"risk":0.3855,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6395"},"relatedVulnerabilities":[{"id":"CVE-2025-6395","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6395","cwe":"CWE-476","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6395","date":"2026-11-12","epss":0.00771,"percentile":0.56141}],"urls":["https://access.redhat.com/errata/RHSA-2025:16115","https://access.redhat.com/errata/RHSA-2025:16116","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:17348","https://access.redhat.com/errata/RHSA-2025:17361","https://access.redhat.com/errata/RHSA-2025:17415","https://access.redhat.com/errata/RHSA-2025:19088","https://access.redhat.com/errata/RHSA-2025:22529","https://access.redhat.com/security/cve/CVE-2025-6395","https://bugzilla.redhat.com/show_bug.cgi?id=2376755","https://gitlab.com/gnutls/gnutls/-/issues/1718","https://lists.gnupg.org/pipermail/gnutls-help/2025-July/004883.html","http://www.openwall.com/lists/oss-security/2025/07/11/3","https://lists.debian.org/debian-lts-announce/2025/08/msg00005.html","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6395","description":"A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite()."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5260","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5260","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-12","epss":0.00769,"percentile":0.56082}],"risk":0.3845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5260"},"relatedVulnerabilities":[{"id":"CVE-2026-5260","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5260","cwe":"CWE-126","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5260","date":"2026-11-12","epss":0.00769,"percentile":0.56082}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:67837","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:77320","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82811","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:89651","https://access.redhat.com/security/cve/CVE-2026-5260","https://bugzilla.redhat.com/show_bug.cgi?id=2467450","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-10"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5260","description":"A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed by a PKCS#11 token, could trigger a short heap overread. This memory corruption vulnerability could lead to information disclosure."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4176","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4176","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"risk":0.37,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4176"},"relatedVulnerabilities":[{"id":"CVE-2026-4176","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4176","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-4176","date":"2026-11-12","epss":0.0074,"percentile":0.55094}],"urls":["https://github.com/Perl/perl5/commit/c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94","https://lists.security.metacpan.org/cve-announce/msg/37638919/","https://metacpan.org/release/PMQS/Compress-Raw-Zlib-2.221/source/Changes","https://metacpan.org/release/SHAY/perl-5.40.4/changes","https://metacpan.org/release/SHAY/perl-5.42.2/changes","https://www.cve.org/CVERecord?id=CVE-2026-3381","http://www.openwall.com/lists/oss-security/2026/03/30/2"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4176","description":"Perl versions from 5.9.4 before 5.40.4-RC1, from 5.41.0 before 5.42.2-RC1, from 5.43.0 before 5.43.9 contain a vulnerable version of Compress::Raw::Zlib.\n\nCompress::Raw::Zlib is included in the Perl package as a dual-life core module, and is vulnerable to CVE-2026-3381 due to a vendored version of zlib which has several vulnerabilities, including CVE-2026-27171. The bundled Compress::Raw::Zlib was updated to version 2.221 in Perl blead commit c75ae9cc164205e1b6d6dbd57bd2c65c8593fe94."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-12","epss":0.0122,"percentile":0.69088}],"risk":0.366,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-12","epss":0.0122,"percentile":0.69088}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-75806","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-75806","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-12","epss":0.0122,"percentile":0.69088}],"risk":0.366,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-75806"},"relatedVulnerabilities":[{"id":"CVE-2026-75806","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-75806","cwe":"CWE-1284","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-75806","date":"2026-11-12","epss":0.0122,"percentile":0.69088}],"urls":["https://github.com/openssl/openssl/commit/04728a289a823e68137f88da016cb9ede307217d","https://github.com/openssl/openssl/commit/050b275cd671a6eed1d6457642d41a5a77aab972","https://github.com/openssl/openssl/commit/3a4589d015a9049d47b66f186cf50a8711343a1d","https://github.com/openssl/openssl/commit/5af82fefbaf2b5fec2fc0e1d87f112844902f01d","https://openssl-library.org/news/secadv/20260929.txt","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-75806","description":"Issue summary: An established DTLS 1.2 association using an AEAD cipher suite\ncan be terminated by a single unauthenticated datagram whose encrypted\nfragment is shorter than the mandatory explicit IV and authentication tag\noverhead.\n\nImpact summary: An attacker who can send a datagram that is routed to an\nexisting DTLS 1.2 association can tear that association down without knowing\nany key material. This is a Denial of Service limited to the targeted\nassociation. There is no memory safety or confidentiality impact.\n\nCWE: CWE-1284: Improper Validation of Specified Quantity in Input\n\nDescription: In TLS 1.2 and DTLS 1.2 every record protected by an AEAD cipher\nsuite carries an explicit IV followed by the ciphertext and an authentication\ntag. When decrypting such a record the record layer passed the record length to\nthe cipher implementation before checking that the record was long enough to\ncontain the explicit IV and the tag. For a record shorter than that overhead the\ncipher implementation rejected the impossible length, and the record layer\ntreated this as an internal failure and raised a fatal internal_error alert\ninstead of treating the record as one that failed authentication.\n\nIn TLS 1.2 the same record causes a fatal internal_error alert instead of the\nexpected bad_record_mac alert. Since any undecryptable record already\nterminates a TLS connection, this is a protocol conformance issue rather than\na security issue in TLS.\n\nThe fix validates the record length against the explicit IV and tag length\nbefore any AEAD processing, so that TLS reports bad_record_mac and DTLS\nsilently discards the record.\n\nFIPS impact: no\nThe affected code is outside the FIPS module boundary."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42015","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42015","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-11-12","epss":0.00727,"percentile":0.54662}],"risk":0.36350000000000005,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42015"},"relatedVulnerabilities":[{"id":"CVE-2026-42015","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42015","cwe":"CWE-193","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42015","date":"2026-11-12","epss":0.00727,"percentile":0.54662}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-42015","https://bugzilla.redhat.com/show_bug.cgi?id=2467678","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-11"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42015","description":"A flaw was found in gnutls. An off-by-one error exists in the PKCS#12 bag element bounds check. This vulnerability allows an remote attacker to write past the internal array of a PKCS#12 bag when appending to a bag that already contains 32 elements. This memory corruption could lead to a denial of service (DoS) or potentially other unspecified impacts."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50079","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50079"},"relatedVulnerabilities":[{"id":"CVE-2025-50079","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50079","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50080","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50080"},"relatedVulnerabilities":[{"id":"CVE-2025-50080","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50080","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50092","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50092"},"relatedVulnerabilities":[{"id":"CVE-2025-50092","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50092","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50093","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50093","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50093"},"relatedVulnerabilities":[{"id":"CVE-2025-50093","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50093","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50079","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50079"},"relatedVulnerabilities":[{"id":"CVE-2025-50079","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50079","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50080","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50080"},"relatedVulnerabilities":[{"id":"CVE-2025-50080","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50080","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50092","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50092"},"relatedVulnerabilities":[{"id":"CVE-2025-50092","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50092","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50093","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50093","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50093"},"relatedVulnerabilities":[{"id":"CVE-2025-50093","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50093","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50079","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50079","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50079"},"relatedVulnerabilities":[{"id":"CVE-2025-50079","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50079","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50079","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50079","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50080","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50080","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50080"},"relatedVulnerabilities":[{"id":"CVE-2025-50080","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50080","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50080","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50080","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Stored Procedure).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50092","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50092","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50092"},"relatedVulnerabilities":[{"id":"CVE-2025-50092","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50092","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50092","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50092","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50093","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50093","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50093"},"relatedVulnerabilities":[{"id":"CVE-2025-50093","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50093","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50093","date":"2026-11-12","epss":0.00688,"percentile":0.53214}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50093","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50077","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50077"},"relatedVulnerabilities":[{"id":"CVE-2025-50077","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50077","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50091","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50091"},"relatedVulnerabilities":[{"id":"CVE-2025-50091","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50091","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50077","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50077"},"relatedVulnerabilities":[{"id":"CVE-2025-50077","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50077","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50091","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50091"},"relatedVulnerabilities":[{"id":"CVE-2025-50091","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50091","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50077","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50077","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50077"},"relatedVulnerabilities":[{"id":"CVE-2025-50077","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50077","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50077","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50077","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50091","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50091","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"risk":0.344,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50091"},"relatedVulnerabilities":[{"id":"CVE-2025-50091","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50091","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50091","date":"2026-11-12","epss":0.00688,"percentile":0.53213}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50091","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"ff982be65dc32dfc","cpes":["cpe:2.3:a:libgcrypt20:libgcrypt20:1.8.5-5ubuntu1.1:*:*:*:*:*:*:*"],"name":"libgcrypt20","purl":"pkg:deb/ubuntu/libgcrypt20@1.8.5-5ubuntu1.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.8.5-5ubuntu1.1","language":"","licenses":["sha256:8f11910ef604ead72fbdc0c0caa641e3f955f66c4868175310ed7290e32b0f37"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgcrypt20/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcrypt20/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcrypt20:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2024-2236","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libgcrypt20","version":"1.8.5-5ubuntu1.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2024-2236","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-11-12","epss":0.0114,"percentile":0.6707}],"risk":0.34199999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2024-2236"},"relatedVulnerabilities":[{"id":"CVE-2024-2236","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2024-2236","cwe":"CWE-385","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2024-2236","date":"2026-11-12","epss":0.0114,"percentile":0.6707}],"urls":["https://access.redhat.com/errata/RHSA-2024:9404","https://access.redhat.com/errata/RHSA-2025:3530","https://access.redhat.com/errata/RHSA-2025:3534","https://access.redhat.com/security/cve/CVE-2024-2236","https://bugzilla.redhat.com/show_bug.cgi?id=2245218","https://bugzilla.redhat.com/show_bug.cgi?id=2268268","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-2236","description":"A timing-based side-channel flaw was found in libgcrypt's RSA implementation. This issue may allow a remote attacker to initiate a Bleichenbacher-style attack, which can lead to the decryption of RSA ciphertexts."}]},{"artifact":{"id":"68b2eaee91f56791","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.34-7ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=pcre2","type":"deb","version":"10.34-7ubuntu0.1","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2022-41409","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pcre2","version":"10.34-7ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2022-41409","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"risk":0.3363,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2022-41409"},"relatedVulnerabilities":[{"id":"CVE-2022-41409","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2022-41409","cwe":"CWE-190","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2022-41409","date":"2026-11-12","epss":0.01121,"percentile":0.66649}],"urls":["https://github.com/PCRE2Project/pcre2/commit/94e1c001761373b7d9450768aa15d04c25547a35","https://github.com/PCRE2Project/pcre2/issues/141"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41409","description":"Integer overflow vulnerability in pcre2test before 10.41 allows attackers to cause a denial of service or other unspecified impacts via negative input."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-114691","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-114691","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"risk":0.335,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-114691"},"relatedVulnerabilities":[{"id":"CVE-2026-114691","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-114691","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-114691","date":"2026-11-12","epss":0.0067,"percentile":0.5248}],"urls":["https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98115","https://access.redhat.com/errata/RHSA-2026:98524","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-114691","https://bugzilla.redhat.com/show_bug.cgi?id=2478508"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-114691","description":"A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50082","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50082"},"relatedVulnerabilities":[{"id":"CVE-2025-50082","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50082","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50082","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50082"},"relatedVulnerabilities":[{"id":"CVE-2025-50082","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50082","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50082","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50082","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50082"},"relatedVulnerabilities":[{"id":"CVE-2025-50082","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50082","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50082","date":"2026-11-12","epss":0.00661,"percentile":0.52136}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50082","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50078","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50078"},"relatedVulnerabilities":[{"id":"CVE-2025-50078","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50078","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50083","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50083"},"relatedVulnerabilities":[{"id":"CVE-2025-50083","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50083","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50078","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50078"},"relatedVulnerabilities":[{"id":"CVE-2025-50078","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50078","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50083","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50083"},"relatedVulnerabilities":[{"id":"CVE-2025-50083","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50083","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50078","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50078","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50078"},"relatedVulnerabilities":[{"id":"CVE-2025-50078","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50078","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50078","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50078","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50083","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50083","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"risk":0.3305,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50083"},"relatedVulnerabilities":[{"id":"CVE-2025-50083","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50083","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50083","date":"2026-11-12","epss":0.00661,"percentile":0.52135}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50083","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-14831","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-14831","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-14831","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14831","date":"2026-11-12","epss":0.00656,"percentile":0.51914}],"risk":0.328,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-14831"},"relatedVulnerabilities":[{"id":"CVE-2025-14831","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-14831","cwe":"CWE-407","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-14831","date":"2026-11-12","epss":0.00656,"percentile":0.51914}],"urls":["https://access.redhat.com/errata/RHSA-2026:13812","https://access.redhat.com/errata/RHSA-2026:16008","https://access.redhat.com/errata/RHSA-2026:16009","https://access.redhat.com/errata/RHSA-2026:16174","https://access.redhat.com/errata/RHSA-2026:25096","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:3477","https://access.redhat.com/errata/RHSA-2026:4188","https://access.redhat.com/errata/RHSA-2026:4655","https://access.redhat.com/errata/RHSA-2026:4943","https://access.redhat.com/errata/RHSA-2026:5585","https://access.redhat.com/errata/RHSA-2026:5606","https://access.redhat.com/errata/RHSA-2026:6618","https://access.redhat.com/errata/RHSA-2026:6630","https://access.redhat.com/errata/RHSA-2026:6737","https://access.redhat.com/errata/RHSA-2026:6738","https://access.redhat.com/errata/RHSA-2026:7329","https://access.redhat.com/errata/RHSA-2026:7335","https://access.redhat.com/errata/RHSA-2026:7477","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:8746","https://access.redhat.com/errata/RHSA-2026:8747","https://access.redhat.com/errata/RHSA-2026:8748","https://access.redhat.com/security/cve/CVE-2025-14831","https://bugzilla.redhat.com/show_bug.cgi?id=2423177","https://gitlab.com/gnutls/gnutls/-/issues/1773","https://cert-portal.siemens.com/productcert/html/ssa-032379.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-14831","description":"A flaw was found in GnuTLS. This vulnerability allows a denial of service (DoS) by excessive CPU (Central Processing Unit) and memory consumption via specially crafted malicious certificates containing a large number of name constraints and subject alternative names (SANs)."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"risk":0.3215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"risk":0.3215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"risk":0.3215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-8376","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-8376","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"risk":0.3215,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-8376"},"relatedVulnerabilities":[{"id":"CVE-2026-8376","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-8376","cwe":"CWE-680","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-8376","date":"2026-11-12","epss":0.00643,"percentile":0.51326}],"urls":["https://github.com/Perl/perl5/commit/5e7f119eb2bb1181be908701f22bf7068e722f1c.patch","http://www.openwall.com/lists/oss-security/2026/05/26/1","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-8376","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.11 have a heap buffer overflow when compiling regular expressions with a repeated fixed string on 32-bit builds.\n\nPerl_study_chunk in regcomp_study.c checked the size of the joined substring buffer in characters rather than bytes. For a quantified fixed substring with a large minimum count, the byte length mincount * l could overflow SSize_t, producing an undersized SvGROW allocation; the subsequent copy writes past the end of the buffer.\n\nA caller that compiles an attacker-controlled regular expression on a 32-bit perl build triggers a heap buffer overflow at compile time."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2017-20230","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2017-20230","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"risk":0.3205,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2017-20230"},"relatedVulnerabilities":[{"id":"CVE-2017-20230","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"impactScore":6.1,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2017-20230","cwe":"CWE-121","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2017-20230","date":"2026-11-12","epss":0.00641,"percentile":0.51225}],"urls":["https://github.com/Perl/perl5/commit/a258c17c6937f79529c8319a829310e09cdbd216.patch","https://github.com/Perl/perl5/issues/15831","https://metacpan.org/release/RURBAN/Storable-3.05/changes","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242533.html","https://www.nntp.perl.org/group/perl.perl5.porters/2017/01/msg242703.html","http://www.openwall.com/lists/oss-security/2026/04/21/5"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-20230","description":"Storable versions before 3.05 for Perl has a stack overflow.\n\nThe retrieve_hook function stored the length of the class name into a signed integer but in read operations treated the length as unsigned. This allowed an attacker to craft data that could trigger the overflow."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50084"},"relatedVulnerabilities":[{"id":"CVE-2025-50084","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50084","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50086","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50086"},"relatedVulnerabilities":[{"id":"CVE-2025-50086","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50086","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50084"},"relatedVulnerabilities":[{"id":"CVE-2025-50084","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50084","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50086","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50086"},"relatedVulnerabilities":[{"id":"CVE-2025-50086","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50086","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50084","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50084","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50084"},"relatedVulnerabilities":[{"id":"CVE-2025-50084","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50084","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50084","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50084","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50086","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50086","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"risk":0.3185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50086"},"relatedVulnerabilities":[{"id":"CVE-2025-50086","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50086","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50086","date":"2026-11-12","epss":0.00637,"percentile":0.51026}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50086","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-12","epss":0.0106,"percentile":0.65001}],"risk":0.318,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42766"},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-12","epss":0.0106,"percentile":0.65001}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-12","epss":0.0106,"percentile":0.65001}],"risk":0.318,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42766"},"relatedVulnerabilities":[{"id":"CVE-2026-42766","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42766","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-42766","date":"2026-11-12","epss":0.0106,"percentile":0.65001}],"urls":["https://github.com/openssl/openssl/commit/056d06c1918fafbb98c1c85a02e4c47cc4e199ce","https://github.com/openssl/openssl/commit/12bc26ffb3a2be728c9b86e1cae277de5b33dfa4","https://github.com/openssl/openssl/commit/3ff64913615d648cfbb6a6f1cf5529ae7ea829d7","https://github.com/openssl/openssl/commit/ab52d88cb5374876d59aee3c91f9e4ccce2b7ce4","https://github.com/openssl/openssl/commit/da26f368732b83e40e9d356fe61c3d3aaab6d2e8","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42766","description":"Issue summary: A specially crafted password-encrypted CMS message\ncan trigger a NULL pointer dereference during CMS decryption.\n\nImpact summary: This NULL pointer dereference leads to an application crash\nand a Denial of Service.\n\nThe CMS PasswordRecipientInfo.keyDerivationAlgorithm field is defined as\nOPTIONAL in the ASN.1 specification and may therefore be absent in specially\ncrafted inputs. During the password-based CMS decryption the OpenSSL\nCMS implementation dereferences this field without first checking whether it\nwas present.\n\nAn attacker who supplies such a CMS message to an application performing\npassword-based CMS decryption can trigger an application crash, leading to\na Denial of Service.\n\nApplications that process password-encrypted CMS messages may be affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4, and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-26604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-26604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-11-12","epss":0.01051,"percentile":0.64751}],"risk":0.3153,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-26604"},"relatedVulnerabilities":[{"id":"CVE-2023-26604","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-11-12","epss":0.01051,"percentile":0.64751}],"urls":["http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html","https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/","https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340","https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html","https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7","https://security.netapp.com/advisory/ntap-20230505-0009/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26604","description":"systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the \"systemctl status\" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-26604","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-26604","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-11-12","epss":0.01051,"percentile":0.64751}],"risk":0.3153,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-26604"},"relatedVulnerabilities":[{"id":"CVE-2023-26604","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-26604","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2023-26604","date":"2026-11-12","epss":0.01051,"percentile":0.64751}],"urls":["http://packetstormsecurity.com/files/174130/systemd-246-Local-Root-Privilege-Escalation.html","https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-2-insecure-functionality/","https://github.com/systemd/systemd/blob/main/NEWS#L4335-L4340","https://lists.debian.org/debian-lts-announce/2023/03/msg00032.html","https://medium.com/%40zenmoviefornotification/saidov-maxim-cve-2023-26604-c1232a526ba7","https://security.netapp.com/advisory/ntap-20230505-0009/","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-26604","description":"systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which the \"systemctl status\" command may be executed. Specifically, systemd does not set LESSSECURE to 1, and thus other programs may be launched from the less program. This presents a substantial security risk when running systemctl from Sudo, because less executes as root when the terminal size is too small to show the complete systemctl output."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-82560","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-82560","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"risk":0.315,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-82560"},"relatedVulnerabilities":[{"id":"CVE-2026-82560","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-82560","cwe":"CWE-835","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-82560","date":"2026-11-12","epss":0.0063,"percentile":0.5069}],"urls":["https://github.com/rra/podlators/commit/70510174f69eb54aa6d617bde4e1402cd9b7c61f.patch","https://metacpan.org/release/RRA/podlators-v6.1.0/source/lib/Pod/Text.pm#L245-261","https://metacpan.org/release/RRA/podlators-v6.1.1/changes","http://www.openwall.com/lists/oss-security/2026/09/19/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-82560","description":"Pod::Text versions before 6.1.1 for Perl allow CPU and memory exhaustion formatting a POD document whose =over nesting drives the margin to the output width.\n\nEach =over adds its indent to the margin, which wrap() subtracts from the output width to get the space available for text. When that space reaches zero, the line-splitting substitution matches the empty string, and the loop consumes no input while appending the margin padding on every pass.\n\nFormatting an attacker-supplied POD document never returns, and the output grows until memory is exhausted."}]},{"artifact":{"id":"90f01f5eff81b5a4","cpes":["cpe:2.3:a:libncurses6:libncurses6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libncurses6","purl":"pkg:deb/ubuntu/libncurses6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libncurses6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libncurses6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"e32f4840d075659e","cpes":["cpe:2.3:a:libncursesw6:libncursesw6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libncursesw6","purl":"pkg:deb/ubuntu/libncursesw6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libncursesw6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libncursesw6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"c0e8162ddfa39d24","cpes":["cpe:2.3:a:libtinfo6:libtinfo6:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"libtinfo6","purl":"pkg:deb/ubuntu/libtinfo6@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libtinfo6/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libtinfo6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libtinfo6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"d216f520e408f718","cpes":["cpe:2.3:a:ncurses-base:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-base:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_base:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-base:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_base:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"ncurses-base","purl":"pkg:deb/ubuntu/ncurses-base@6.2-0ubuntu2.1?arch=all&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/ncurses-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-base.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"84cc756d53f210c6","cpes":["cpe:2.3:a:ncurses-bin:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses-bin:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses_bin:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses-bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*","cpe:2.3:a:ncurses:ncurses_bin:6.2-0ubuntu2.1:*:*:*:*:*:*:*"],"name":"ncurses-bin","purl":"pkg:deb/ubuntu/ncurses-bin@6.2-0ubuntu2.1?arch=amd64&distro=ubuntu-20.04&upstream=ncurses","type":"deb","version":"6.2-0ubuntu2.1","language":"","licenses":["sha256:dced00c014dbe91a9179d6d92497d04c225c613cab85ba704aaa987369eadae3"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/ncurses-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/ncurses-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/ncurses-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/ncurses-bin.list"}],"upstreams":[{"name":"ncurses"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-50495","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"ncurses","version":"6.2-0ubuntu2.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-50495","fix":{"state":"not-fixed","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"risk":0.3111,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-50495"},"relatedVulnerabilities":[{"id":"CVE-2023-50495","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-50495","date":"2026-11-12","epss":0.01037,"percentile":0.64377}],"urls":["https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00020.html","https://lists.gnu.org/archive/html/bug-ncurses/2023-04/msg00029.html","https://security.netapp.com/advisory/ntap-20240119-0008/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LU4MYMKFEZQ5VSCVLRIZGDQOUW3T44GT/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-50495","description":"NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry()."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-4039","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-4039","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"risk":0.31079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-4039"},"relatedVulnerabilities":[{"id":"CVE-2023-4039","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"arm-security@arm.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4.8,"impactScore":2.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-4039","cwe":"CWE-693","type":"Secondary","source":"arm-security@arm.com"},{"cve":"CVE-2023-4039","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-4039","date":"2026-11-12","epss":0.01036,"percentile":0.64359}],"urls":["https://developer.arm.com/Arm%20Security%20Center/GCC%20Stack%20Protector%20Vulnerability%20AArch64","https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-x7ch-h5rf-w2mf","https://cert-portal.siemens.com/productcert/html/ssa-355557.html","https://cert-portal.siemens.com/productcert/html/ssa-398330.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-4039","description":"**DISPUTED**A failure in the -fstack-protector feature in GCC-based toolchains \nthat target AArch64 allows an attacker to exploit an existing buffer \noverflow in dynamically-sized local variables in your application \nwithout this being detected. This stack-protector failure only applies \nto C99-style dynamically-sized local variables or those created using \nalloca(). The stack-protector operates as intended for statically-sized \nlocal variables.\n\nThe default behavior when the stack-protector \ndetects an overflow is to terminate your application, resulting in \ncontrolled loss of availability. An attacker who can exploit a buffer \noverflow without triggering the stack-protector might be able to change \nprogram flow control to cause an uncontrolled loss of availability or to\n go further and affect confidentiality or integrity. NOTE: The GCC project argues that this is a missed hardening bug and not a vulnerability by itself."}]},{"artifact":{"id":"fd6ba8236976331d","cpes":["cpe:2.3:a:gzip:gzip:1.10-0ubuntu4.1:*:*:*:*:*:*:*"],"name":"gzip","purl":"pkg:deb/ubuntu/gzip@1.10-0ubuntu4.1?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.10-0ubuntu4.1","language":"","licenses":["sha256:f9ac4a5d7a670e3891881a2cdba5fa2cd625c4d58eae4a7aa372ac00a06803bd"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gzip/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gzip/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gzip.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gzip.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gzip.list"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-41992","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gzip","version":"1.10-0ubuntu4.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-41992","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-41992","cwe":"CWE-126","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-41992","date":"2026-11-12","epss":0.0062,"percentile":0.502}],"risk":0.31,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-41992"},"relatedVulnerabilities":[{"id":"CVE-2026-41992","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cvd@cert.pl","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-41992","cwe":"CWE-126","type":"Secondary","source":"cvd@cert.pl"}],"epss":[{"cve":"CVE-2026-41992","date":"2026-11-12","epss":0.0062,"percentile":0.502}],"urls":["https://cert.pl/en/posts/2026/04/CVE-2026-41991/","https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681","https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=e7378c2d421be6a286922374425680bbe9ad8b7d","https://www.gnu.org/software/gzip/","http://www.openwall.com/lists/oss-security/2026/08/23/1","http://www.openwall.com/lists/oss-security/2026/08/25/1","http://www.openwall.com/lists/oss-security/2026/08/27/2"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-41992","description":"GNU gzip contains a global buffer overflow vulnerability in the LZH decompression logic caused by improper reuse of shared global state between different decompression formats within a single execution. GNU gzip maintains a global array that is shared across the LZ77, LZW, and LZH decompression routines and is not reinitialized between files processed in the same invocation.\nBy decompressing a specially crafted LZW file followed by a specially crafted LZH file in a single gzip -d command, an attacker can poison the shared global state and subsequently trigger an out‑of‑bounds read in the LZH decoder. The LZH decompression logic follows stale values left in the shared array, causing reads past the end of the allocated global buffer.\n\nThis issue has been fixed in commits 63dbf6b3b9e6e781df1a6a64e609b10e23969681 and e7378c2d421be6a286922374425680bbe9ad8b7d."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0915","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-11-12","epss":0.00618,"percentile":0.50136}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0915"},"relatedVulnerabilities":[{"id":"CVE-2026-0915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-11-12","epss":0.00618,"percentile":0.50136}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0915","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-11-12","epss":0.00618,"percentile":0.50136}],"risk":0.309,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0915"},"relatedVulnerabilities":[{"id":"CVE-2026-0915","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0915","date":"2026-11-12","epss":0.00618,"percentile":0.50136}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-12","epss":0.01025,"percentile":0.64044}],"risk":0.3075,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34180"},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-12","epss":0.01025,"percentile":0.64044}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-34180","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-34180","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-12","epss":0.01025,"percentile":0.64044}],"risk":0.3075,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-34180"},"relatedVulnerabilities":[{"id":"CVE-2026-34180","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-34180","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-34180","date":"2026-11-12","epss":0.01025,"percentile":0.64044}],"urls":["https://github.com/openssl/openssl/commit/1c6908e4fa5fa568752221d8eaf561a809751e5d","https://github.com/openssl/openssl/commit/cbe418ae978539cf14a398a207dba834c0e93e83","https://github.com/openssl/openssl/commit/d93853c42110d6319e3df07842b488cb9f7ac5ff","https://github.com/openssl/openssl/commit/da5d62af75f69d6fbf7803743d7c56ac75461e43","https://github.com/openssl/openssl/commit/f696c73c3e61b8c502d040af62e690c060908a16","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-34180","description":"Issue summary: Parsing a crafted DER-encoded ASN.1 structure with a primitive\nelement whose content exceeds 2 gigabytes in length may cause a heap buffer\nover-read on 64-bit Unix and Unix-like platforms.\n\nImpact summary: The heap buffer over-read may crash the application (Denial of\nService) or to load into the decoded ASN.1 object contents of memory beyond the\nend of the input buffer.  More typically such ASN.1 elements would instead be\ntruncated.\n\nAn integer truncation in OpenSSL's ASN.1 decoder causes the content length of\nan ASN.1 primitive element to be mishandled when it exceeds 2 gigabytes. In the\nworst case the truncated length is treated as a request to scan the binary\ncontent for a terminating zero byte, possibly causing OpenSSL to read either\nless than or beyond the end of the allocated buffer.\n\nApplications that pass attacker-supplied data to d2i_X509(), d2i_PKCS7(), or\nany other d2i_* decoding function are affected. OpenSSL's own command-line\ntools are not vulnerable, as data read through the BIO layer is checked before\nit reaches the affected code. The issue only affects 64-bit Unix and Unix-like\nplatforms; 32-bit platforms and 64-bit Windows are not affected.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53023"},"relatedVulnerabilities":[{"id":"CVE-2025-53023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53023","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53023"},"relatedVulnerabilities":[{"id":"CVE-2025-53023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53023","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53023","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53023","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53023"},"relatedVulnerabilities":[{"id":"CVE-2025-53023","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53023","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53023","date":"2026-11-12","epss":0.00597,"percentile":0.49067}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53023","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are 8.0.0-8.0.42. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50094"},"relatedVulnerabilities":[{"id":"CVE-2025-50094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50094","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.42, 8.4.5 and  9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50094"},"relatedVulnerabilities":[{"id":"CVE-2025-50094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50094","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.42, 8.4.5 and  9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"risk":0.2985,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50094"},"relatedVulnerabilities":[{"id":"CVE-2025-50094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50094","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50094","date":"2026-11-12","epss":0.00597,"percentile":0.49066}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50094","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.42, 8.4.5 and  9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"risk":0.297,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"risk":0.297,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"risk":0.297,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-12087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-12087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"risk":0.297,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-12087"},"relatedVulnerabilities":[{"id":"CVE-2026-12087","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-12087","cwe":"CWE-125","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-12087","cwe":"CWE-805","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-12087","date":"2026-11-12","epss":0.00594,"percentile":0.48878}],"urls":["https://github.com/Perl/perl5/commit/de19a0b0ad1900fef976c5c1400bd8f11ec6c6cb.patch","https://metacpan.org/release/PEVANS/Socket-2.041/changes","http://www.openwall.com/lists/oss-security/2026/06/15/10","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-12087","description":"Socket versions before 2.041 for Perl have an out-of-bounds heap read.\n\nIn Socket.xs, pack_ip_mreq_source() checks the length of its source argument before the argument is read, so the check tests the byte length carried over from the preceding multiaddr argument instead. Both addresses occupy a 4-byte field, so a valid multiaddr lets a source of any length pass the check, and the source is then copied into the 4-byte imr_sourceaddr field with a fixed-size copy. A source shorter than 4 bytes is not rejected, and the copy reads up to 3 bytes past the end of its buffer.\n\nCalling pack_ip_mreq_source() with a source value shorter than 4 bytes copies adjacent heap memory into the returned packed structure."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-19487","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-19487","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"risk":0.2935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-19487"},"relatedVulnerabilities":[{"id":"CVE-2026-19487","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-19487","cwe":"CWE-670","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-19487","date":"2026-11-12","epss":0.00587,"percentile":0.48541}],"urls":["https://github.com/Perl/perl5/commit/1a21abacaf6f684928bae8baaa153733c8c238eb.patch","https://github.com/Perl/perl5/issues/22892","http://www.openwall.com/lists/oss-security/2026/08/13/8","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-19487","description":"Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in S_find_byclass.\n\nThe prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one recorded. A failing transition sets the failed flag, and a later successful transition does not clear it, so the prescan reads the stale flag as a failure and stops before it can record a candidate that starts earlier. It takes a subject where one candidate is recorded and a later character then forces a fallback through a fail link that succeeds.\n\nExample:\n\n  \"ABCDE\" =~ m/ABCF|BCDE|C/;    # matches C at offset 2, not BCDE\n  \"ABCDE\" =~ m/ABCF|BCDE|C(G)/; # no match, BCDE missed\n\nAn alternation like this can miss input it should match, or match it on the wrong branch, so an access or filtering decision made from the result can be wrong."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53042","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53042","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53042"},"relatedVulnerabilities":[{"id":"CVE-2025-53042","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53042","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53044","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53044"},"relatedVulnerabilities":[{"id":"CVE-2025-53044","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53044","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53045","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53045"},"relatedVulnerabilities":[{"id":"CVE-2025-53045","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53045","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53069"},"relatedVulnerabilities":[{"id":"CVE-2025-53069","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53069","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53042","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53042","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53042"},"relatedVulnerabilities":[{"id":"CVE-2025-53042","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53042","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53044","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53044"},"relatedVulnerabilities":[{"id":"CVE-2025-53044","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53044","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53045","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53045"},"relatedVulnerabilities":[{"id":"CVE-2025-53045","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53045","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53069"},"relatedVulnerabilities":[{"id":"CVE-2025-53069","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53069","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53042","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53042","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53042"},"relatedVulnerabilities":[{"id":"CVE-2025-53042","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53042","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53042","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53042","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53044","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53044","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53044"},"relatedVulnerabilities":[{"id":"CVE-2025-53044","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53044","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53044","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53044","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53045","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53045","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53045"},"relatedVulnerabilities":[{"id":"CVE-2025-53045","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53045","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53045","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53045","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53069","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53069","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53069"},"relatedVulnerabilities":[{"id":"CVE-2025-53069","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53069","cwe":"CWE-770","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53069","date":"2026-11-12","epss":0.00584,"percentile":0.4843}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53069","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53040","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53040"},"relatedVulnerabilities":[{"id":"CVE-2025-53040","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53040","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53062","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53062","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53062"},"relatedVulnerabilities":[{"id":"CVE-2025-53062","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53062","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53040","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53040"},"relatedVulnerabilities":[{"id":"CVE-2025-53040","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53040","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53062","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53062","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53062"},"relatedVulnerabilities":[{"id":"CVE-2025-53062","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53062","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53040","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53040","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53040"},"relatedVulnerabilities":[{"id":"CVE-2025-53040","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53040","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53040","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53040","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53062","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53062","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"risk":0.292,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53062"},"relatedVulnerabilities":[{"id":"CVE-2025-53062","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53062","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53062","date":"2026-11-12","epss":0.00584,"percentile":0.48429}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53062","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50102","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50102","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50102"},"relatedVulnerabilities":[{"id":"CVE-2025-50102","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50102","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50102","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50102","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50102"},"relatedVulnerabilities":[{"id":"CVE-2025-50102","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50102","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50102","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50102","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"risk":0.2905,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50102"},"relatedVulnerabilities":[{"id":"CVE-2025-50102","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50102","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50102","date":"2026-11-12","epss":0.00581,"percentile":0.48221}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50102","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20796"},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2018-20796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"risk":0.2902,"urls":[],"severity":"Negligible","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2018-20796"},"relatedVulnerabilities":[{"id":"CVE-2018-20796","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.0","vendorMetadata":{}},{"type":"Primary","source":"nvd@nist.gov","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"impactScore":2.9,"exploitabilityScore":10},"version":"2.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2018-20796","date":"2026-11-12","epss":0.05804,"percentile":0.93233}],"urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&amp%3Butm_medium=RSS"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50097","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50097"},"relatedVulnerabilities":[{"id":"CVE-2025-50097","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50097","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50097","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50097"},"relatedVulnerabilities":[{"id":"CVE-2025-50097","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50097","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50097","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50097","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50097"},"relatedVulnerabilities":[{"id":"CVE-2025-50097","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50097","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50097","date":"2026-11-12","epss":0.00576,"percentile":0.47994}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50097","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50099","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50099","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50099"},"relatedVulnerabilities":[{"id":"CVE-2025-50099","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50099","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50101","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50101"},"relatedVulnerabilities":[{"id":"CVE-2025-50101","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50101","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50099","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50099","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50099"},"relatedVulnerabilities":[{"id":"CVE-2025-50099","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50099","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50101","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50101"},"relatedVulnerabilities":[{"id":"CVE-2025-50101","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50101","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50099","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50099","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50099"},"relatedVulnerabilities":[{"id":"CVE-2025-50099","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50099","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50099","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50099","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50101","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50101","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"risk":0.28800000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50101"},"relatedVulnerabilities":[{"id":"CVE-2025-50101","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50101","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50101","date":"2026-11-12","epss":0.00576,"percentile":0.47993}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50101","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48959","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48959","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"risk":0.28600000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48959"},"relatedVulnerabilities":[{"id":"CVE-2026-48959","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48959","cwe":"CWE-407","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-48959","date":"2026-11-12","epss":0.00572,"percentile":0.47788}],"urls":["https://github.com/pmqs/IO-Compress/commit/68db44076f4c1a86a2ffe53a958eac6cabaf72e2.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/2","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48959","description":"IO::Uncompress::Unzip versions before 2.220 for Perl allow CPU exhaustion via per-byte read loop in fastForward.\n\nfastForward() compares length $offset (the digit count of the offset, 1 to 19) against the chunk size $c instead of $offset itself, so $c shrinks from 16 KiB to 1-19 bytes per iteration.\n\nExtracting a named entry from an attacker supplied zip via IO::Uncompress::Unzip->new($zip, Name => $target) drives a per-byte read loop scaling with the entry's compressed size, up to the non-Zip64 4 GiB cap."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-12","epss":0.00944,"percentile":0.61535}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69421"},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-12","epss":0.00944,"percentile":0.61535}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69421","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-12","epss":0.00944,"percentile":0.61535}],"risk":0.2832,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69421"},"relatedVulnerabilities":[{"id":"CVE-2025-69421","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69421","date":"2026-11-12","epss":0.00944,"percentile":0.61535}],"urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-3833","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-3833","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-3833","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3833","date":"2026-11-12","epss":0.00565,"percentile":0.47422}],"risk":0.2825,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-3833"},"relatedVulnerabilities":[{"id":"CVE-2026-3833","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-3833","cwe":"CWE-178","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-3833","date":"2026-11-12","epss":0.00565,"percentile":0.47422}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:57402","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:62409","https://access.redhat.com/errata/RHSA-2026:62549","https://access.redhat.com/errata/RHSA-2026:65839","https://access.redhat.com/errata/RHSA-2026:65851","https://access.redhat.com/errata/RHSA-2026:67857","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/security/cve/CVE-2026-3833","https://bugzilla.redhat.com/show_bug.cgi?id=2445763","https://gitlab.com/gnutls/gnutls/-/issues/1803"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3833","description":"A flaw was found in gnutls. This vulnerability occurs because gnutls performs case-sensitive comparisons of `nameConstraints` labels, specifically for `dNSName` (DNS) or `rfc822Name` (email) constraints within `excludedSubtrees` or `permittedSubtrees`. A remote attacker can exploit this by crafting a leaf certificate with casing differences in the Subject Alternative Name (SAN), leading to a policy bypass where a certificate that should be rejected is instead accepted. This could result in unauthorized access or information disclosure."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-12","epss":0.0092,"percentile":0.60764}],"risk":0.27599999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69420"},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-12","epss":0.0092,"percentile":0.60764}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69420","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-12","epss":0.0092,"percentile":0.60764}],"risk":0.27599999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69420"},"relatedVulnerabilities":[{"id":"CVE-2025-69420","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69420","date":"2026-11-12","epss":0.0092,"percentile":0.60764}],"urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"risk":0.2757,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28388"},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28388","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28388","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"risk":0.2757,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28388"},"relatedVulnerabilities":[{"id":"CVE-2026-28388","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28388","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28388","date":"2026-11-12","epss":0.00919,"percentile":0.6074}],"urls":["https://github.com/openssl/openssl/commit/59c3b3158553ab53275bbbccca5cb305d591cf2e","https://github.com/openssl/openssl/commit/5a0b4930779cd2408880979db765db919da55139","https://github.com/openssl/openssl/commit/602542f2c0c2d5edb47128f93eac10b62aeeefb3","https://github.com/openssl/openssl/commit/a9d187dd1000130100fa7ab915f8513532cb3bb8","https://github.com/openssl/openssl/commit/d3a901e8d9f021f3e67d6cfbc12e768129862726","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28388","description":"Issue summary: When a delta CRL that contains a Delta CRL Indicator extension\nis processed a NULL pointer dereference might happen if the required CRL\nNumber extension is missing.\n\nImpact summary: A NULL pointer dereference can trigger a crash which\nleads to a Denial of Service for an application.\n\nWhen CRL processing and delta CRL processing is enabled during X.509\ncertificate verification, the delta CRL processing does not check\nwhether the CRL Number extension is NULL before dereferencing it.\nWhen a malformed delta CRL file is being processed, this parameter\ncan be NULL, causing a NULL pointer dereference.\n\nExploiting this issue requires the X509_V_FLAG_USE_DELTAS flag to be enabled in\nthe verification context, the certificate being verified to contain a\nfreshestCRL extension or the base CRL to have the EXFLAG_FRESHEST flag set, and\nan attacker to provide a malformed CRL to an application that processes it.\n\nThe vulnerability is limited to Denial of Service and cannot be escalated to\nachieve code execution or memory disclosure. For that reason the issue was\nassessed as Low severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"risk":0.268,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"risk":0.268,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"risk":0.268,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-57433","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-57433","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"risk":0.268,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-57433"},"relatedVulnerabilities":[{"id":"CVE-2026-57433","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-57433","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-57433","date":"2026-11-12","epss":0.00536,"percentile":0.45679}],"urls":["https://github.com/Perl/perl5/commit/e4f681784bcdeaa91ff02a2fa4cdcae5c46779d7.patch","http://www.openwall.com/lists/oss-security/2026/07/13/7","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-57433","description":"Storable versions before 3.41 for Perl have a signed integer overflow when deserializing a crafted SX_HOOK record.\n\nretrieve_hook_common reads a signed 32-bit item count from an SX_HOOK record and calls av_extend with that count plus one. A count of I32_MAX wraps the addition to a negative value.\n\nA crafted blob passed to thaw or retrieve triggers the overflow; av_extend receives the negative count and dies with a panic, terminating the deserialization."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-13221","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-13221","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"risk":0.2625,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-13221"},"relatedVulnerabilities":[{"id":"CVE-2026-13221","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-13221","cwe":"CWE-190","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-13221","date":"2026-11-12","epss":0.00525,"percentile":0.45038}],"urls":["https://github.com/Perl/perl5/commit/03f74bbbd3a68350d926ee93d56ee4808c28c4c7.patch","https://github.com/Perl/perl5/issues/23388","http://www.openwall.com/lists/oss-security/2026/07/13/5","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-13221","description":"Perl versions before 5.40.5-RC1, from 5.41.0 before 5.42.3-RC1, from 5.43.0 before 5.43.10 produce silently incorrect regular expression matches when an alternation of more than 65535 fixed string branches is compiled into a trie in Perl_study_chunk.\n\nWhen such branches are combined into a trie, the delta between the first branch and the shared tail is stored in a 16-bit field. A branch count above 65535 overflows the field, and the trie's match decision table is truncated with no warning or error.\n\nA pattern of this shape produces false positive matches (matching strings it should not) and false negative matches (failing to match strings it should). When such a pattern gates an access or filtering decision, the result is wrong."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50085","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50085","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"risk":0.2615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50085"},"relatedVulnerabilities":[{"id":"CVE-2025-50085","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50085","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50085","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50085","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"risk":0.2615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50085"},"relatedVulnerabilities":[{"id":"CVE-2025-50085","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50085","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50085","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50085","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"risk":0.2615,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50085"},"relatedVulnerabilities":[{"id":"CVE-2025-50085","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50085","cwe":"CWE-863","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50085","date":"2026-11-12","epss":0.00523,"percentile":0.44886}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50085","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"risk":0.261,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50087"},"relatedVulnerabilities":[{"id":"CVE-2025-50087","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50087","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"risk":0.261,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50087"},"relatedVulnerabilities":[{"id":"CVE-2025-50087","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50087","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50087","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50087","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"risk":0.261,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50087"},"relatedVulnerabilities":[{"id":"CVE-2025-50087","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50087","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50087","date":"2026-11-12","epss":0.00522,"percentile":0.44794}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50087","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server accessible data. CVSS 3.1 Base Score 4.9 (Integrity impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50098","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50098"},"relatedVulnerabilities":[{"id":"CVE-2025-50098","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50098","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50098","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50098"},"relatedVulnerabilities":[{"id":"CVE-2025-50098","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50098","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50098","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50098","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50098"},"relatedVulnerabilities":[{"id":"CVE-2025-50098","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50098","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50098","date":"2026-11-12","epss":0.00521,"percentile":0.44713}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50098","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50104","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50104"},"relatedVulnerabilities":[{"id":"CVE-2025-50104","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50104","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50104","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50104"},"relatedVulnerabilities":[{"id":"CVE-2025-50104","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50104","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50104","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50104","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"risk":0.2605,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50104"},"relatedVulnerabilities":[{"id":"CVE-2025-50104","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.7,"impactScore":1.5,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50104","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50104","date":"2026-11-12","epss":0.00521,"percentile":0.44712}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50104","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.7 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-12","epss":0.00518,"percentile":0.44579}],"risk":0.259,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63379"},"relatedVulnerabilities":[{"id":"CVE-2026-63379","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-12","epss":0.00518,"percentile":0.44579}],"urls":["https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63379","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63379","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-12","epss":0.00518,"percentile":0.44579}],"risk":0.259,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63379"},"relatedVulnerabilities":[{"id":"CVE-2026-63379","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63379","cwe":"CWE-444","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63379","date":"2026-11-12","epss":0.00518,"percentile":0.44579}],"urls":["https://github.com/libevent/libevent/commit/87e8e44fa774e9677b089b1a5114ee68aefa1636","https://github.com/libevent/libevent/commit/b847071141b3827900d536594ec9045eb0a4c485","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-2gmv-p5m7-98p6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63379","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttp_read_trailer and merges them into request headers. The fix introduces evhttp_parse_headers_impl_ and a temporary trailer header list. An unauthenticated remote attacker can place security-sensitive fields in trailers so that an upstream proxy and the libevent application interpret different effective headers, enabling header smuggling, authorization bypass, proxy-header spoofing, or cache poisoning. The fix parses trailers into a temporary header list and discards them instead of merging them into req->input_headers. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9538","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9538","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"risk":0.2585,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9538"},"relatedVulnerabilities":[{"id":"CVE-2026-9538","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9538","cwe":"CWE-789","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-9538","date":"2026-11-12","epss":0.00517,"percentile":0.44516}],"urls":["https://github.com/jib/archive-tar-new/commit/f9af01426038e29d9578825a0cd3626946ab08c7.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.10/changes","http://www.openwall.com/lists/oss-security/2026/05/26/4"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9538","description":"Archive::Tar versions before 3.10 for Perl allow memory exhaustion via attacker controlled entry size field in tar header.\n\n_read_tar() reads each entry's payload with $handle->read($$data, $block), where $block is derived from the entry's 12-byte size field in the tar header with no upper bound on that value.\n\nA crafted header declaring a multi-gigabyte size causes Perl to allocate a scalar of that size."}]},{"artifact":{"id":"5e3f99daab9a1514","cpes":["cpe:2.3:a:libsystemd0:libsystemd0:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libsystemd0","purl":"pkg:deb/ubuntu/libsystemd0@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libsystemd0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libsystemd0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libsystemd0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-7008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-7008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-11-12","epss":0.00842,"percentile":0.58397}],"risk":0.2526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-7008"},"relatedVulnerabilities":[{"id":"CVE-2023-7008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-11-12","epss":0.00842,"percentile":0.58397}],"urls":["https://access.redhat.com/errata/RHSA-2024:2463","https://access.redhat.com/errata/RHSA-2024:3203","https://access.redhat.com/security/cve/CVE-2023-7008","https://bugzilla.redhat.com/show_bug.cgi?id=2222261","https://bugzilla.redhat.com/show_bug.cgi?id=2222672","https://github.com/systemd/systemd/issues/25676","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/","https://security.netapp.com/advisory/ntap-20241122-0004/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-7008","description":"A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records."}]},{"artifact":{"id":"7fb6e4c8e297c76a","cpes":["cpe:2.3:a:libudev1:libudev1:245.4-4ubuntu3.24:*:*:*:*:*:*:*"],"name":"libudev1","purl":"pkg:deb/ubuntu/libudev1@245.4-4ubuntu3.24?arch=amd64&distro=ubuntu-20.04&upstream=systemd","type":"deb","version":"245.4-4ubuntu3.24","language":"","licenses":["CC0-1.0","Expat","GPL-2","GPL-2+","LGPL-2.1","LGPL-2.1+","public-domain"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libudev1/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libudev1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libudev1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libudev1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"systemd"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2023-7008","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"systemd","version":"245.4-4ubuntu3.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2023-7008","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-11-12","epss":0.00842,"percentile":0.58397}],"risk":0.2526,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2023-7008"},"relatedVulnerabilities":[{"id":"CVE-2023-7008","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2023-7008","cwe":"CWE-300","type":"Secondary","source":"secalert@redhat.com"},{"cve":"CVE-2023-7008","cwe":"NVD-CWE-Other","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2023-7008","date":"2026-11-12","epss":0.00842,"percentile":0.58397}],"urls":["https://access.redhat.com/errata/RHSA-2024:2463","https://access.redhat.com/errata/RHSA-2024:3203","https://access.redhat.com/security/cve/CVE-2023-7008","https://bugzilla.redhat.com/show_bug.cgi?id=2222261","https://bugzilla.redhat.com/show_bug.cgi?id=2222672","https://github.com/systemd/systemd/issues/25676","https://lists.debian.org/debian-lts-announce/2024/09/msg00001.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4GMDEG5PKONWNHOEYSUDRT6JEOISRMN2/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QHNBXGKJWISJETTTDTZKTBFIBJUOSLKL/","https://security.netapp.com/advisory/ntap-20241122-0004/","https://cert-portal.siemens.com/productcert/html/ssa-794697.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-7008","description":"A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-11-12","epss":0.00502,"percentile":0.43502}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5450"},"relatedVulnerabilities":[{"id":"CVE-2026-5450","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-11-12","epss":0.00502,"percentile":0.43502}],"urls":["https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5450","description":"Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5450","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5450","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-11-12","epss":0.00502,"percentile":0.43502}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5450"},"relatedVulnerabilities":[{"id":"CVE-2026-5450","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"impactScore":5.9,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5450","cwe":"CWE-122","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"},{"cve":"CVE-2026-5450","cwe":"CWE-787","type":"Primary","source":"nvd@nist.gov"}],"epss":[{"cve":"CVE-2026-5450","date":"2026-11-12","epss":0.00502,"percentile":0.43502}],"urls":["https://inbox.sourceware.org/libc-announce/b11f0003-6ec1-4bd6-b9de-9e38a4efeca3@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=CVE-2026-5450","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5450","description":"Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one byte heap buffer overflow."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42496","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42496","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"risk":0.251,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42496"},"relatedVulnerabilities":[{"id":"CVE-2026-42496","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","metrics":{"baseScore":8.2,"impactScore":6.1,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"impactScore":5.2,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42496","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42496","cwe":"CWE-22","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-42496","date":"2026-11-12","epss":0.00502,"percentile":0.43477}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42497","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30852","https://access.redhat.com/errata/RHSA-2026:30856","https://access.redhat.com/errata/RHSA-2026:30857","https://access.redhat.com/security/cve/CVE-2026-42496","https://bugzilla.redhat.com/show_bug.cgi?id=2481314","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42496.json"],"severity":"Critical","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42496","description":"Archive::Tar versions before 3.08 for Perl extract symlinks with attacker controlled targets outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to symlink() without validating it against absolute paths or .. segments. The secure-extract mode check that guards regular file extraction does not cover the symlink target.\n\nA subsequent open through the extracted name reads or writes the attacker chosen path."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.25079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28389"},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28390","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.25079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28390"},"relatedVulnerabilities":[{"id":"CVE-2026-28390","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28389","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28389","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.25079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28389"},"relatedVulnerabilities":[{"id":"CVE-2026-28389","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28389","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28389","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/16cea4188e0ea567deb4f93f85902247e67384f5","https://github.com/openssl/openssl/commit/785cbf7ea3b5a6f5adf0c1ccb92b79d89c35c616","https://github.com/openssl/openssl/commit/7b5274e812400cacb6f3be4c2df5340923fa807f","https://github.com/openssl/openssl/commit/c6725634e089eb2b634b10ede33944be7248172a","https://github.com/openssl/openssl/commit/f80f83bc5fd036bc47d773e8b15a001e2b4ce686","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28389","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyAgreeRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyAgreeRecipientInfo is\nprocessed, the optional parameters field of KeyEncryptionAlgorithmIdentifier\nis examined without checking for its presence. This results in a NULL\npointer dereference if the field is missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28390","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28390","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"risk":0.25079999999999997,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28390"},"relatedVulnerabilities":[{"id":"CVE-2026-28390","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28390","cwe":"CWE-476","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28390","date":"2026-11-12","epss":0.00836,"percentile":0.58207}],"urls":["https://github.com/openssl/openssl/commit/01194a8f1941115cd0383bfa91c736dd3993c8bc","https://github.com/openssl/openssl/commit/2e39b7a6993be445fddb9fbce316fa756e0397b6","https://github.com/openssl/openssl/commit/af2a5fecd3e71a29e7568f9c1453dec5cebbaff4","https://github.com/openssl/openssl/commit/ea7b4ea4f9f853521ba34830cbcadc970d2e0788","https://github.com/openssl/openssl/commit/fd2f1a6cf53b9ceeca723a001aa4b825d7c7ee75","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28390","description":"Issue summary: During processing of a crafted CMS EnvelopedData message\nwith KeyTransportRecipientInfo a NULL pointer dereference can happen.\n\nImpact summary: Applications that process attacker-controlled CMS data may\ncrash before authentication or cryptographic operations occur resulting in\nDenial of Service.\n\nWhen a CMS EnvelopedData message that uses KeyTransportRecipientInfo with\nRSA-OAEP encryption is processed, the optional parameters field of\nRSA-OAEP SourceFunc algorithm identifier is examined without checking\nfor its presence. This results in a NULL pointer dereference if the field\nis missing.\n\nApplications and services that call CMS_decrypt() on untrusted input\n(e.g., S/MIME processing or CMS-based protocols) are vulnerable.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the affected code is outside the OpenSSL FIPS module boundary."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-40909","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-40909","fix":{"state":"not-fixed","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"risk":0.24949999999999997,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-40909"},"relatedVulnerabilities":[{"id":"CVE-2025-40909","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.9,"impactScore":3.4,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-40909","cwe":"CWE-426","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2025-40909","cwe":"CWE-689","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2025-40909","date":"2026-11-12","epss":0.00499,"percentile":0.43299}],"urls":["https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1098226","https://github.com/Perl/perl5/commit/11a11ecf4bea72b17d250cfb43c897be1341861e","https://github.com/Perl/perl5/commit/918bfff86ca8d6d4e4ec5b30994451e0bd74aba9.patch","https://github.com/Perl/perl5/issues/10387","https://github.com/Perl/perl5/issues/23010","https://perldoc.perl.org/5.14.0/perl5136delta#Directory-handles-not-copied-to-threads","https://www.openwall.com/lists/oss-security/2025/05/22/2","http://seclists.org/fulldisclosure/2025/Sep/53","http://seclists.org/fulldisclosure/2025/Sep/54","http://seclists.org/fulldisclosure/2025/Sep/55","http://www.openwall.com/lists/oss-security/2025/05/23/1","http://www.openwall.com/lists/oss-security/2025/05/30/4","http://www.openwall.com/lists/oss-security/2025/06/02/2","http://www.openwall.com/lists/oss-security/2025/06/02/5","http://www.openwall.com/lists/oss-security/2025/06/02/6","http://www.openwall.com/lists/oss-security/2025/06/02/7","http://www.openwall.com/lists/oss-security/2025/06/03/1","https://lists.debian.org/debian-lts-announce/2026/04/msg00018.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-40909","description":"Perl threads have a working directory race condition where file operations may target unintended paths.\n\nIf a directory handle is open at thread creation, the process-wide current working directory is temporarily changed in order to clone that handle for the new thread, which is visible from any third (or more) thread already running. \n\nThis may lead to unintended operations such as loading code or accessing files from unexpected locations, which a local attacker may be able to exploit.\n\nThe bug was introduced in commit 11a11ecf4bea72b17d250cfb43c897be1341861e and released in Perl version 5.13.6"}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15281","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-11-12","epss":0.00491,"percentile":0.42738}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15281"},"relatedVulnerabilities":[{"id":"CVE-2025-15281","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-11-12","epss":0.00491,"percentile":0.42738}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-15281","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-11-12","epss":0.00491,"percentile":0.42738}],"risk":0.24550000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-15281"},"relatedVulnerabilities":[{"id":"CVE-2025-15281","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2025-15281","date":"2026-11-12","epss":0.00491,"percentile":0.42738}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process."}]},{"artifact":{"id":"c98e6dac9c14f84d","cpes":["cpe:2.3:a:tar:tar:1.30\\+dfsg-7ubuntu0.20.04.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.30%2Bdfsg-7ubuntu0.20.04.4?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.30+dfsg-7ubuntu0.20.04.4","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-45582","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"tar","version":"1.30+dfsg-7ubuntu0.20.04.4"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-45582","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-11-12","epss":0.0049,"percentile":0.4266}],"risk":0.245,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-45582"},"relatedVulnerabilities":[{"id":"CVE-2025-45582","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L","metrics":{"baseScore":4.1,"impactScore":2.8,"exploitabilityScore":1.1},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-45582","cwe":"CWE-24","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2025-45582","date":"2026-11-12","epss":0.0049,"percentile":0.4266}],"urls":["https://github.com/i900008/vulndb/blob/main/Gnu_tar_vuln.md","https://lists.gnu.org/archive/html/bug-tar/2025-08/msg00012.html","https://www.gnu.org/software/tar/","https://www.gnu.org/software/tar/manual/html_node/Integrity.html","https://www.gnu.org/software/tar/manual/html_node/Security-rules-of-thumb.html","http://www.openwall.com/lists/oss-security/2025/11/01/6"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-45582","description":"GNU Tar through 1.35 allows file overwrite via directory traversal in crafted TAR archives, with a certain two-step process. First, the victim must extract an archive that contains a ../ symlink to a critical directory. Second, the victim must extract an archive that contains a critical file, specified via a relative pathname that begins with the symlink name and ends with that critical file's name. Here, the extraction follows the symlink and overwrites the critical file. This bypasses the protection mechanism of \"Member name contains '..'\" that would occur for a single TAR archive that attempted to specify the critical file via a ../ approach. For example, the first archive can contain \"x -> ../../../../../home/victim/.ssh\" and the second archive can contain x/authorized_keys. This can affect server applications that automatically extract any number of user-supplied TAR archives, and were relying on the blocking of traversal. This can also affect software installation processes in which \"tar xf\" is run more than once (e.g., when installing a package can automatically install two dependencies that are set up as untrusted tarballs instead of official packages). NOTE: the official GNU Tar manual has an otherwise-empty directory for each \"tar xf\" in its Security Rules of Thumb; however, third-party advice leads users to run \"tar xf\" more than once into the same directory."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63383"},"relatedVulnerabilities":[{"id":"CVE-2026-63383","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"urls":["https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63383","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63384"},"relatedVulnerabilities":[{"id":"CVE-2026-63384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"urls":["https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63384","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63383"},"relatedVulnerabilities":[{"id":"CVE-2026-63383","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63383","cwe":"CWE-125","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63383","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"urls":["https://github.com/libevent/libevent/commit/91ed8745eebabdd27592a83d350338a8c4626321","https://github.com/libevent/libevent/commit/e1f9e21887c6b104e206a718385ba3ffc75180cb","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-fj29-64w6-73h6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63383","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent can read beyond a contiguous evbuffer region in event_tagging.c when decode_tag_internal requests at most five bytes from evbuffer_pullup but iterates using the full logical buffer length. A fragmented evbuffer containing a six-byte malformed tag can therefore advance past the pullup window and trigger an out-of-bounds read, which can crash a process that decodes attacker-controlled tagged RPC data. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63384","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63384","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"risk":0.244,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63384"},"relatedVulnerabilities":[{"id":"CVE-2026-63384","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"version":"4.0","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63384","cwe":"CWE-190","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63384","date":"2026-11-12","epss":0.00488,"percentile":0.42524}],"urls":["https://github.com/libevent/libevent/commit/109c16499282959d70f56ec3baf4c8b1e6646bda","https://github.com/libevent/libevent/commit/5e3c6ebe342b34c5a9bcf48e9a32ad6708b9c416","https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-45c6-qx49-89m8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63384","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an incorrect integer conversion in event_tagging.c when evtag_unmarshal_header uses evtag_decode_int to decode an attacker-controlled uint32 payload length and returns it as a signed int. Values above INT_MAX become negative or truncated, and evtag_unmarshal_string can use the converted value in allocation sizing, producing a wrapped large allocation request and denial of service. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61094","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61094","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61094"},"relatedVulnerabilities":[{"id":"CVE-2026-61094","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61094","cwe":"CWE-269","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"cve":"CVE-2026-61094","cwe":"CWE-306","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61094","date":"2026-11-12","epss":0.00486,"percentile":0.42336}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61094","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60316","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60316","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"risk":0.243,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60316"},"relatedVulnerabilities":[{"id":"CVE-2026-60316","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"impactScore":5.9,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60316","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60316","date":"2026-11-12","epss":0.00486,"percentile":0.42334}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60316","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.2 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-12","epss":0.00804,"percentile":0.57223}],"risk":0.2412,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7383"},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-12","epss":0.00804,"percentile":0.57223}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7383","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7383","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-12","epss":0.00804,"percentile":0.57223}],"risk":0.2412,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7383"},"relatedVulnerabilities":[{"id":"CVE-2026-7383","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7383","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-7383","date":"2026-11-12","epss":0.00804,"percentile":0.57223}],"urls":["https://github.com/openssl/openssl/commit/4f8d2bddaa2c8e06f9c33390ee1717059a6e4be6","https://github.com/openssl/openssl/commit/80c15faaf78042bbb8654a0e234c50c381732f74","https://github.com/openssl/openssl/commit/bd17511070fb39a67bfa19682affb765e706a974","https://github.com/openssl/openssl/commit/c332adaced43bcbb85f97410597e951c11ec3083","https://github.com/openssl/openssl/commit/d32350ae8ef7426718f5aa9e383d4b51398ee255","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7383","description":"Issue summary: A signed integer overflow when sizing the destination\nbuffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap\nbuffer overflow.\n\nImpact summary: A heap buffer overflow may lead to a crash or possibly\nattacker controlled code execution or other undefined behaviour.\n\nIn ASN1_mbstring_copy() and ASN1_mbstring_ncopy() the destination\nsize for Unicode output is computed in a signed int: by left shift\nof the input character count for BMPSTRING (UTF-16) and\nUNIVERSALSTRING (UTF-32), and by summing per-character byte counts\nfor UTF8STRING. The calculation overflows when the input reaches\naround 2^30 characters. In the worst case (UNIVERSALSTRING at 2^30\ncharacters) the size wraps to zero, OPENSSL_malloc(1) is called, and\nthe subsequent character copy writes several gigabytes past the\none-byte allocation.\n\nX.509 certificate processing routes through ASN1_STRING_set_by_NID(),\nwhose DIRSTRING_TYPE mask excludes UNIVERSALSTRING and whose per-NID\nsize limits cap the input length; no network protocol or\ncertificate-handling path in OpenSSL exercises the overflow.\nTriggering the bug requires an application that calls\nASN1_mbstring_copy() or ASN1_mbstring_ncopy() directly, or registers\na custom string type via ASN1_STRING_TABLE_add(), with\nattacker-controlled input on the order of half a gigabyte or more.\nFor these reasons this issue was assigned Low severity.\n\nThe FIPS modules in 4.0, 3.6, 3.5, 3.4 and 3.0 are not affected by\nthis issue, as the affected code is outside the OpenSSL FIPS module\nboundary."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.241,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.241,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-95619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-95619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"risk":0.241,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-95619"},"relatedVulnerabilities":[{"id":"CVE-2026-95619","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":7.7,"impactScore":5.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-95619","cwe":"CWE-190","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-95619","date":"2026-11-12","epss":0.00482,"percentile":0.42087}],"urls":["https://access.redhat.com/errata/RHSA-2026:58503","https://access.redhat.com/errata/RHSA-2026:67275","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/security/cve/CVE-2026-95619","https://bugzilla.redhat.com/show_bug.cgi?id=2537811"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-95619","description":"A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corruption or application instability."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53053","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53053","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53053"},"relatedVulnerabilities":[{"id":"CVE-2025-53053","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53053","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53054","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53054","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53054"},"relatedVulnerabilities":[{"id":"CVE-2025-53054","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53054","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53053","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53053","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53053"},"relatedVulnerabilities":[{"id":"CVE-2025-53053","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53053","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53054","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53054","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53054"},"relatedVulnerabilities":[{"id":"CVE-2025-53054","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53054","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53053","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53053","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53053"},"relatedVulnerabilities":[{"id":"CVE-2025-53053","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53053","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53053","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53053","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-53054","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-53054","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"risk":0.24,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-53054"},"relatedVulnerabilities":[{"id":"CVE-2025-53054","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":5.5,"impactScore":4.3,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-53054","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-53054","date":"2026-11-12","epss":0.0048,"percentile":0.41944}],"urls":["https://www.oracle.com/security-alerts/cpuoct2025.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-53054","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.43, 8.4.0-8.4.6 and  9.0.0-9.4.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server as well as  unauthorized update, insert or delete access to some of MySQL Server accessible data. CVSS 3.1 Base Score 5.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:H)."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42011","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42011","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42011","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42011","date":"2026-11-12","epss":0.00475,"percentile":0.41563}],"risk":0.2375,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42011"},"relatedVulnerabilities":[{"id":"CVE-2026-42011","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42011","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42011","date":"2026-11-12","epss":0.00475,"percentile":0.41563}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:95508","https://access.redhat.com/errata/RHSA-2026:95745","https://access.redhat.com/errata/RHSA-2026:95755","https://access.redhat.com/security/cve/CVE-2026-42011","https://bugzilla.redhat.com/show_bug.cgi?id=2467437","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-6"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42011","description":"A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101679","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101679","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"risk":0.23700000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101679"},"relatedVulnerabilities":[{"id":"CVE-2026-101679","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101679","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101679","date":"2026-11-12","epss":0.00474,"percentile":0.41481}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101679","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42497","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42497","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42497"},"relatedVulnerabilities":[{"id":"CVE-2026-42497","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42497","cwe":"CWE-59","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-42497","cwe":"CWE-732","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-42497","date":"2026-11-12","epss":0.00473,"percentile":0.41412}],"urls":["https://github.com/jib/archive-tar-new/commit/17c873492a05eddc0de18c1485e0b2cccd5a9158.patch","https://metacpan.org/release/BINGOS/Archive-Tar-3.08/changes","https://www.cve.org/CVERecord?id=CVE-2026-42496","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42497","description":"Archive::Tar versions before 3.08 for Perl extract hardlinks to attacker controlled paths outside the extraction directory.\n\n_make_special_file() passes the tar header's linkname to link() without validating it against absolute paths or .. segments, creating a hardlink that shares the victim file's inode.\n\nA subsequent write through the extracted name modifies the victim file, and the post-extraction chmod, chown, and utime block in _extract_file() (guarded only against symlinks via -l) applies the tar header's mode, owner, and timestamps to the shared inode during extraction alone."}]},{"artifact":{"id":"c98e6dac9c14f84d","cpes":["cpe:2.3:a:tar:tar:1.30\\+dfsg-7ubuntu0.20.04.4:*:*:*:*:*:*:*"],"name":"tar","purl":"pkg:deb/ubuntu/tar@1.30%2Bdfsg-7ubuntu0.20.04.4?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.30+dfsg-7ubuntu0.20.04.4","language":"","licenses":["sha256:9292780f2dfd11900e92ea67c7a316cf9df740b955956f87ec099a5b4f3d9136"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/tar/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/tar/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/tar.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.list"},{"path":"/var/lib/dpkg/info/tar.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.postinst"},{"path":"/var/lib/dpkg/info/tar.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/tar.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-5704","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"tar","version":"1.30+dfsg-7ubuntu0.20.04.4"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5704","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-12","epss":0.00473,"percentile":0.41388}],"risk":0.2365,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5704"},"relatedVulnerabilities":[{"id":"CVE-2026-5704","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.5,"impactScore":3.6,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N","metrics":{"baseScore":5,"impactScore":3.6,"exploitabilityScore":1.4},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5704","cwe":"CWE-434","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-5704","date":"2026-11-12","epss":0.00473,"percentile":0.41388}],"urls":["https://access.redhat.com/errata/RHSA-2026:61581","https://access.redhat.com/errata/RHSA-2026:61586","https://access.redhat.com/errata/RHSA-2026:61783","https://access.redhat.com/errata/RHSA-2026:66018","https://access.redhat.com/errata/RHSA-2026:66514","https://access.redhat.com/errata/RHSA-2026:70390","https://access.redhat.com/security/cve/CVE-2026-5704","https://bugzilla.redhat.com/show_bug.cgi?id=2455360","http://www.openwall.com/lists/oss-security/2026/04/11/10","http://www.openwall.com/lists/oss-security/2026/04/11/11","http://www.openwall.com/lists/oss-security/2026/04/12/2"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5704","description":"A flaw was found in tar. A remote attacker could exploit this vulnerability by crafting a malicious archive, leading to hidden file injection with fully attacker-controlled content. This bypasses pre-extraction inspection mechanisms, potentially allowing an attacker to introduce malicious files onto a system without detection."}]},{"artifact":{"id":"675f3769b731031e","cpes":["cpe:2.3:a:libpam-modules:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-modules","purl":"pkg:deb/ubuntu/libpam-modules@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-modules/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"7bbc781302c446e0","cpes":["cpe:2.3:a:libpam-modules-bin:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules-bin:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules_bin:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-modules:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_modules:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-modules-bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_modules_bin:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-modules-bin","purl":"pkg:deb/ubuntu/libpam-modules-bin@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-modules-bin/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-modules-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-modules-bin.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-modules-bin.list"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"b1941eab59e8cd62","cpes":["cpe:2.3:a:libpam-runtime:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam-runtime:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam_runtime:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam-runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*","cpe:2.3:a:libpam:libpam_runtime:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam-runtime","purl":"pkg:deb/ubuntu/libpam-runtime@1.3.1-5ubuntu4.7?arch=all&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam-runtime/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam-runtime/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.conffiles","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam-runtime.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.list"},{"path":"/var/lib/dpkg/info/libpam-runtime.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.postinst"},{"path":"/var/lib/dpkg/info/libpam-runtime.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.postrm"},{"path":"/var/lib/dpkg/info/libpam-runtime.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.prerm"},{"path":"/var/lib/dpkg/info/libpam-runtime.templates","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam-runtime.templates"}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"55b776a7ae80291d","cpes":["cpe:2.3:a:libpam0g:libpam0g:1.3.1-5ubuntu4.7:*:*:*:*:*:*:*"],"name":"libpam0g","purl":"pkg:deb/ubuntu/libpam0g@1.3.1-5ubuntu4.7?arch=amd64&distro=ubuntu-20.04&upstream=pam","type":"deb","version":"1.3.1-5ubuntu4.7","language":"","licenses":["sha256:7c584b7b1f37b612da7fdf3b076eb2b2c1bae72865f0699d745ae2ac7d40d13e"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpam0g/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpam0g/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpam0g:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pam"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-6020","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pam","version":"1.3.1-5ubuntu4.7"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-6020","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"risk":0.23600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-6020"},"relatedVulnerabilities":[{"id":"CVE-2025-6020","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-6020","cwe":"CWE-22","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2025-6020","date":"2026-11-12","epss":0.00472,"percentile":0.41278}],"urls":["https://access.redhat.com/errata/RHSA-2025:10024","https://access.redhat.com/errata/RHSA-2025:10027","https://access.redhat.com/errata/RHSA-2025:10180","https://access.redhat.com/errata/RHSA-2025:10354","https://access.redhat.com/errata/RHSA-2025:10357","https://access.redhat.com/errata/RHSA-2025:10358","https://access.redhat.com/errata/RHSA-2025:10359","https://access.redhat.com/errata/RHSA-2025:10361","https://access.redhat.com/errata/RHSA-2025:10362","https://access.redhat.com/errata/RHSA-2025:10735","https://access.redhat.com/errata/RHSA-2025:10823","https://access.redhat.com/errata/RHSA-2025:11386","https://access.redhat.com/errata/RHSA-2025:11487","https://access.redhat.com/errata/RHSA-2025:14557","https://access.redhat.com/errata/RHSA-2025:15099","https://access.redhat.com/errata/RHSA-2025:15709","https://access.redhat.com/errata/RHSA-2025:15827","https://access.redhat.com/errata/RHSA-2025:15828","https://access.redhat.com/errata/RHSA-2025:16524","https://access.redhat.com/errata/RHSA-2025:17181","https://access.redhat.com/errata/RHSA-2025:18219","https://access.redhat.com/errata/RHSA-2025:20181","https://access.redhat.com/errata/RHSA-2025:21885","https://access.redhat.com/errata/RHSA-2025:22019","https://access.redhat.com/errata/RHSA-2025:9526","https://access.redhat.com/errata/RHSA-2026:0934","https://access.redhat.com/security/cve/CVE-2025-6020","https://bugzilla.redhat.com/show_bug.cgi?id=2372512","https://github.com/linux-pam/linux-pam/security/advisories/GHSA-f9p8-gjr4-j9gx","http://www.openwall.com/lists/oss-security/2025/06/17/1","https://lists.debian.org/debian-lts-announce/2025/09/msg00021.html","https://cert-portal.siemens.com/productcert/html/ssa-577017.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-6020","description":"A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46863","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46863","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46863"},"relatedVulnerabilities":[{"id":"CVE-2026-46863","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46863","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46863","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46863","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46863"},"relatedVulnerabilities":[{"id":"CVE-2026-46863","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46863","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46863","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46863","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"risk":0.2355,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46863"},"relatedVulnerabilities":[{"id":"CVE-2026-46863","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46863","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46863","date":"2026-11-12","epss":0.00471,"percentile":0.41207}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46863","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Connection Handling).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.9, 9.0.0-9.7.0; MySQL Cluster: 8.0.11-8.0.46, 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101731","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101731","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101731"},"relatedVulnerabilities":[{"id":"CVE-2026-101731","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101731","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101731","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101731","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101732","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101732","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"risk":0.232,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101732"},"relatedVulnerabilities":[{"id":"CVE-2026-101732","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101732","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101732","date":"2026-11-12","epss":0.00464,"percentile":0.40655}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101732","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46862","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46862","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46862"},"relatedVulnerabilities":[{"id":"CVE-2026-46862","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46862","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46862","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46862","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46862"},"relatedVulnerabilities":[{"id":"CVE-2026-46862","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46862","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-46862","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-46862","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"risk":0.23149999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-46862"},"relatedVulnerabilities":[{"id":"CVE-2026-46862","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-46862","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-46862","date":"2026-11-12","epss":0.00463,"percentile":0.40624}],"urls":["https://www.oracle.com/security-alerts/cspujun2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-46862","description":"Vulnerability in the MySQL Router product of Oracle MySQL (component: Router: General).  Supported versions that are affected are 8.4.0-8.4.9 and  9.0.0-9.7.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Router.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Router. CVSS 3.1 Base Score 7.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101724","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101724","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101724"},"relatedVulnerabilities":[{"id":"CVE-2026-101724","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101724","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101724","date":"2026-11-12","epss":0.00454,"percentile":0.39847}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101724","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101721","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101721","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101721"},"relatedVulnerabilities":[{"id":"CVE-2026-101721","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101721","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101721","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101721","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101727","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101727","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101727"},"relatedVulnerabilities":[{"id":"CVE-2026-101727","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101727","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101727","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101727","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101730","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101730","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"risk":0.22699999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101730"},"relatedVulnerabilities":[{"id":"CVE-2026-101730","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101730","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101730","date":"2026-11-12","epss":0.00454,"percentile":0.39846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101730","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47052","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47052","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"risk":0.22499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47052"},"relatedVulnerabilities":[{"id":"CVE-2026-47052","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47052","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47052","date":"2026-11-12","epss":0.0045,"percentile":0.39572}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47052","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-122054","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-122054","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"risk":0.22300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-122054"},"relatedVulnerabilities":[{"id":"CVE-2026-122054","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=25734","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026","http://www.openwall.com/lists/oss-security/2026/11/04/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-122054","description":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-122054","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-122054","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"risk":0.22300000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-122054"},"relatedVulnerabilities":[{"id":"CVE-2026-122054","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-122054","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-122054","date":"2026-11-12","epss":0.00446,"percentile":0.39295}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=25734","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0026","http://www.openwall.com/lists/oss-security/2026/11/04/10"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-122054","description":"Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.18 through 2.31 may result in the converter making no progress, causing the calling application to hang."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101750","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101750","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101750"},"relatedVulnerabilities":[{"id":"CVE-2026-101750","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101750","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101750","date":"2026-11-12","epss":0.00444,"percentile":0.39073}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101750","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101751","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101751","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"risk":0.22200000000000003,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101751"},"relatedVulnerabilities":[{"id":"CVE-2026-101751","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101751","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101751","date":"2026-11-12","epss":0.00444,"percentile":0.39072}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101751","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50100"},"relatedVulnerabilities":[{"id":"CVE-2025-50100","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50100","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50100"},"relatedVulnerabilities":[{"id":"CVE-2025-50100","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50100","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-50100","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-50100","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"risk":0.22,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-50100"},"relatedVulnerabilities":[{"id":"CVE-2025-50100","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":2.2,"impactScore":1.5,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-50100","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2025-50100","date":"2026-11-12","epss":0.0044,"percentile":0.38749}],"urls":["https://www.oracle.com/security-alerts/cpujul2025.html"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-50100","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.42, 8.4.0-8.4.5 and  9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a partial denial of service (partial DOS) of MySQL Server. CVSS 3.1 Base Score 2.2 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L)."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-48962","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-48962","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"risk":0.2195,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-48962"},"relatedVulnerabilities":[{"id":"CVE-2026-48962","cvss":[{"type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"impactScore":5.9,"exploitabilityScore":1.9},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"impactScore":3.4,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-48962","cwe":"CWE-95","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"},{"cve":"CVE-2026-48962","cwe":"CWE-94","type":"Secondary","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"epss":[{"cve":"CVE-2026-48962","date":"2026-11-12","epss":0.00439,"percentile":0.3867}],"urls":["https://github.com/pmqs/IO-Compress/commit/f2db247bf90d4cc7ee2710be384946081f3b4610.patch","https://metacpan.org/release/PMQS/IO-Compress-2.220/changes","http://www.openwall.com/lists/oss-security/2026/05/27/4","https://access.redhat.com/errata/RHSA-2026:29182","https://access.redhat.com/errata/RHSA-2026:29210","https://access.redhat.com/errata/RHSA-2026:29867","https://access.redhat.com/errata/RHSA-2026:29941","https://access.redhat.com/errata/RHSA-2026:30085","https://access.redhat.com/errata/RHSA-2026:30086","https://access.redhat.com/errata/RHSA-2026:30115","https://access.redhat.com/errata/RHSA-2026:30843","https://access.redhat.com/errata/RHSA-2026:30851","https://access.redhat.com/errata/RHSA-2026:30858","https://access.redhat.com/errata/RHSA-2026:30859","https://access.redhat.com/errata/RHSA-2026:30860","https://access.redhat.com/errata/RHSA-2026:50262","https://access.redhat.com/security/cve/CVE-2026-48962","https://bugzilla.redhat.com/show_bug.cgi?id=2481767","https://cert-portal.siemens.com/productcert/html/ssa-457936.html","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-48962.json"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-48962","description":"IO::Compress versions before 2.220 for Perl can execute arbitrary code in File::GlobMapper via an attacker-controlled output glob.\n\n_parseOutputGlob() wraps the caller-supplied output glob string in double quotes and stores it in the parser state; _getFiles() then runs the stored expression through eval STRING. A literal double quote in the output glob closes the dquote wrapper, and the characters that follow are evaluated as Perl.\n\nArbitrary Perl in the output glob executes at the calling process's privilege."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101770","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101770","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"risk":0.2185,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101770"},"relatedVulnerabilities":[{"id":"CVE-2026-101770","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101770","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101770","date":"2026-11-12","epss":0.00437,"percentile":0.38484}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101770","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60315","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60315","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"risk":0.218,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60315"},"relatedVulnerabilities":[{"id":"CVE-2026-60315","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60315","cwe":"CWE-200","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60315","date":"2026-11-12","epss":0.00436,"percentile":0.38359}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60315","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster and  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101619","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101619","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101619"},"relatedVulnerabilities":[{"id":"CVE-2026-101619","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101619","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101619","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101619","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101622","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101622","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101622"},"relatedVulnerabilities":[{"id":"CVE-2026-101622","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101622","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101622","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101622","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101623","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101623","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101623"},"relatedVulnerabilities":[{"id":"CVE-2026-101623","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101623","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101623","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101623","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101729","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101729","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101729"},"relatedVulnerabilities":[{"id":"CVE-2026-101729","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101729","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101729","date":"2026-11-12","epss":0.00434,"percentile":0.38192}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101729","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101621","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101621","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"risk":0.217,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101621"},"relatedVulnerabilities":[{"id":"CVE-2026-101621","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101621","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101621","date":"2026-11-12","epss":0.00434,"percentile":0.38191}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101621","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.21450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.21450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-102010","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-102010","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"risk":0.21450000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-102010"},"relatedVulnerabilities":[{"id":"CVE-2026-102010","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-102010","cwe":"CWE-825","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-102010","date":"2026-11-12","epss":0.00429,"percentile":0.37575}],"urls":["https://access.redhat.com/errata/RHSA-2026:73642","https://access.redhat.com/errata/RHSA-2026:74569","https://access.redhat.com/errata/RHSA-2026:89830","https://access.redhat.com/errata/RHSA-2026:89891","https://access.redhat.com/errata/RHSA-2026:90915","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98474","https://access.redhat.com/errata/RHSA-2026:98475","https://access.redhat.com/errata/RHSA-2026:98483","https://access.redhat.com/errata/RHSA-2026:98576","https://access.redhat.com/errata/RHSA-2026:98577","https://access.redhat.com/errata/RHSA-2026:98580","https://access.redhat.com/errata/RHSA-2026:99032","https://access.redhat.com/errata/RHSA-2026:99041","https://access.redhat.com/errata/RHSA-2026:99089","https://access.redhat.com/security/cve/CVE-2026-102010","https://bugzilla.redhat.com/show_bug.cgi?id=2478395"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-102010","description":"A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit this use-after-free condition, leading to a Denial of Service (DoS) via an application crash or potential memory corruption."}]},{"artifact":{"id":"68b2eaee91f56791","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.34-7ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=pcre2","type":"deb","version":"10.34-7ubuntu0.1","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-86145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pcre2","version":"10.34-7ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-86145","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-12","epss":0.00425,"percentile":0.37215}],"risk":0.21250000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-86145"},"relatedVulnerabilities":[{"id":"CVE-2026-86145","cvss":[{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-86145","cwe":"CWE-424","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-86145","date":"2026-11-12","epss":0.00425,"percentile":0.37215}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-3r4p-g7gg-ppmf","http://www.openwall.com/lists/oss-security/2026/09/05/3"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-86145","description":"PCRE2 before 10.48 allows a pcre2_dfa_match out-of-bounds write because reuse of a cached workspace block, in a recursive DFA matching workspace, lacks a size check (even though a newly allocated block, for the same purpose, does have a size check). This outcome requires an attacker-controlled regular expression, or a recursive pattern in conjunction with a small heap limit (this can be set through the API)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-12","epss":0.00707,"percentile":0.53907}],"risk":0.2121,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9076"},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-12","epss":0.00707,"percentile":0.53907}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-9076","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-9076","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-12","epss":0.00707,"percentile":0.53907}],"risk":0.2121,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-9076"},"relatedVulnerabilities":[{"id":"CVE-2026-9076","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-9076","cwe":"CWE-125","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-9076","date":"2026-11-12","epss":0.00707,"percentile":0.53907}],"urls":["https://github.com/openssl/openssl/commit/05b066366842f930fadd9a6e94df98030af431bb","https://github.com/openssl/openssl/commit/3d8d5bc1056b2f62da9fede23fedbf47e85187b0","https://github.com/openssl/openssl/commit/715349a1d7c6db970e6815dafb90915f07307f98","https://github.com/openssl/openssl/commit/77bf00ab13f6ff5e516535432f0328ed70ec0c26","https://github.com/openssl/openssl/commit/eecbe330977e8d023aae1ca2d9bdbe983ef3fdc6","https://openssl-library.org/news/secadv/20260609.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-9076","description":"Issue summary: When CMS password-based decryption (RFC 3211 / PWRI key unwrap)\nprocesses attacker-supplied CMS data, an attacker-chosen stream-mode KEK\ncipher can trigger a heap out-of-bounds read in kek_unwrap_key().\n\nImpact summary: A heap buffer over-read may trigger a crash which leads to\nDenial of Service for an application if the input buffer ends at a memory\npage boundary and the following page is unmapped. There is no information\ndisclosure as the over-read bytes are not revealed to the attacker.\n\nThe key unwrapping function performs a check-byte test as specified in the\nRFC that reads 7 bytes from a heap allocation that is based on the wrapped\nkey length from the message. There is a minimum length check based on the\nblock length of the wrapping cipher. However the cipher is selected from\nan OID carried in the attacker's PWRI keyEncryptionAlgorithm with no\nrequirement that the cipher be a block cipher. When an attacker selects\na stream-mode cipher the guard will be ineffective and the allocated buffer\ncontaining the unwrapped key can be too small to fit the check-bytes\nspecified in the RFC and a buffer over-read can happen.\n\nApplications calling CMS_decrypt() or CMS_decrypt_set1_password()\n(equivalently openssl cms -decrypt -pwri_password ...) on untrusted CMS\ndata are vulnerable to this issue. No password knowledge is required: the\nover-read happens during the unwrap attempt before any authentication\nsucceeds.\n\nThe over-read is limited to a few bytes and is not written to output, so\nthere is no information disclosure. Triggering a crash requires the\nallocation to border unmapped memory, which is unlikely with the normal\nallocator.\n\nThe FIPS modules are not affected by this issue."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42013","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42013","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42013","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42013","date":"2026-11-12","epss":0.00423,"percentile":0.37048}],"risk":0.21150000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42013"},"relatedVulnerabilities":[{"id":"CVE-2026-42013","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":8.2,"impactScore":4.3,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42013","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42013","date":"2026-11-12","epss":0.00423,"percentile":0.37048}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:40762","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:56853","https://access.redhat.com/errata/RHSA-2026:57483","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:59831","https://access.redhat.com/errata/RHSA-2026:60019","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:95508","https://access.redhat.com/errata/RHSA-2026:95745","https://access.redhat.com/errata/RHSA-2026:95755","https://access.redhat.com/security/cve/CVE-2026-42013","https://bugzilla.redhat.com/show_bug.cgi?id=2467448","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-8"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42013","description":"A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall back to checking the Common Name (CN) field. This could allow a remote attacker to bypass proper certificate validation, potentially leading to spoofing or man-in-the-middle attacks."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-61109","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-61109","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-61109"},"relatedVulnerabilities":[{"id":"CVE-2026-61109","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-61109","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-61109","date":"2026-11-12","epss":0.00422,"percentile":0.37038}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-61109","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101610","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101610","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101610"},"relatedVulnerabilities":[{"id":"CVE-2026-101610","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101610","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101610","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101610","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101613","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101613","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101613"},"relatedVulnerabilities":[{"id":"CVE-2026-101613","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101613","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101613","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101613","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101614","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101614","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"risk":0.211,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101614"},"relatedVulnerabilities":[{"id":"CVE-2026-101614","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101614","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101614","date":"2026-11-12","epss":0.00422,"percentile":0.37002}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101614","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"risk":0.2091,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28387"},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-28387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-28387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"risk":0.2091,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-28387"},"relatedVulnerabilities":[{"id":"CVE-2026-28387","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-28387","cwe":"CWE-416","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-28387","date":"2026-11-12","epss":0.00697,"percentile":0.5355}],"urls":["https://github.com/openssl/openssl/commit/07e727d304746edb49a98ee8f6ab00256e1f012b","https://github.com/openssl/openssl/commit/258a8f63b26995ba357f4326da00e19e29c6acbe","https://github.com/openssl/openssl/commit/444958deaf450aea819171f97ae69eaedede42c3","https://github.com/openssl/openssl/commit/7a4e08cee62a728d32e60b0de89e6764339df0a7","https://github.com/openssl/openssl/commit/ec03fa050b3346997ed9c5fef3d0e16ad7db8177","https://openssl-library.org/news/secadv/20260407.txt","https://cert-portal.siemens.com/productcert/html/ssa-032379.html","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-28387","description":"Issue summary: An uncommon configuration of clients performing DANE TLSA-based\nserver authentication, when paired with uncommon server DANE TLSA records, may\nresult in a use-after-free and/or double-free on the client side.\n\nImpact summary: A use after free can have a range of potential consequences\nsuch as the corruption of valid data, crashes or execution of arbitrary code.\n\nHowever, the issue only affects clients that make use of TLSA records with both\nthe PKIX-TA(0/PKIX-EE(1) certificate usages and the DANE-TA(2) certificate\nusage.\n\nBy far the most common deployment of DANE is in SMTP MTAs for which RFC7672\nrecommends that clients treat as 'unusable' any TLSA records that have the PKIX\ncertificate usages.  These SMTP (or other similar) clients are not vulnerable\nto this issue.  Conversely, any clients that support only the PKIX usages, and\nignore the DANE-TA(2) usage are also not vulnerable.\n\nThe client would also need to be communicating with a server that publishes a\nTLSA RRset with both types of TLSA records.\n\nNo FIPS modules are affected by this issue, the problem code is outside the\nFIPS module boundary."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60145","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60145","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60145"},"relatedVulnerabilities":[{"id":"CVE-2026-60145","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60145","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60145","date":"2026-11-12","epss":0.00416,"percentile":0.36409}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60145","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"9810a09e3c17906a","cpes":["cpe:2.3:a:libevent-core-2.1-7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1-7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1_7:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core-2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core_2.1:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_core:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-core-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_core_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-core-2.1-7","purl":"pkg:deb/ubuntu/libevent-core-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-core-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-core-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-core-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-12","epss":0.00416,"percentile":0.36367}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63387"},"relatedVulnerabilities":[{"id":"CVE-2026-63387","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-12","epss":0.00416,"percentile":0.36367}],"urls":["https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63387","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"82194bcac5cfdb0e","cpes":["cpe:2.3:a:libevent-pthreads-2.1-7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1-7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1_7:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads-2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads_2.1:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent-pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent_pthreads:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent-pthreads-2.1-7:2.1.11-stable-1:*:*:*:*:*:*:*","cpe:2.3:a:libevent:libevent_pthreads_2.1_7:2.1.11-stable-1:*:*:*:*:*:*:*"],"name":"libevent-pthreads-2.1-7","purl":"pkg:deb/ubuntu/libevent-pthreads-2.1-7@2.1.11-stable-1?arch=amd64&distro=ubuntu-20.04&upstream=libevent","type":"deb","version":"2.1.11-stable-1","language":"","licenses":["BSD-2-clause","BSD-3-Clause~Kitware","BSD-3-clause","BSL","Expat","FSFUL","FSFULLR","FSFULLR-No-Warranty","GPL-2","GPL-2+","GPL-3","GPL-3+","ISC","curl"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/libevent-pthreads-2.1-7/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/libevent-pthreads-2.1-7:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"libevent"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-63387","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"libevent","version":"2.1.11-stable-1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-63387","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-12","epss":0.00416,"percentile":0.36367}],"risk":0.208,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-63387"},"relatedVulnerabilities":[{"id":"CVE-2026-63387","cvss":[{"type":"Secondary","source":"security-advisories@github.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H","metrics":{"baseScore":7,"impactScore":4.8,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-63387","cwe":"CWE-121","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-193","type":"Secondary","source":"security-advisories@github.com"},{"cve":"CVE-2026-63387","cwe":"CWE-787","type":"Secondary","source":"security-advisories@github.com"}],"epss":[{"cve":"CVE-2026-63387","date":"2026-11-12","epss":0.00416,"percentile":0.36367}],"urls":["https://github.com/libevent/libevent/releases/tag/release-2.1.13-stable","https://github.com/libevent/libevent/releases/tag/release-2.2.2-alpha","https://github.com/libevent/libevent/security/advisories/GHSA-58rx-7448-jw47"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-63387","description":"Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has an off-by-one stack buffer overflow in evdns.c when dnsname_to_labels formats a name-bearing DNS record at the end of the 64 KB stack buffer allocated by evdns_server_request_format_response. The final-label check permits j plus label_len plus one to equal buf_len, after which the terminating null byte is written to buf[buf_len]. A crafted DNS server response containing PTR, CNAME, MX, NS, or SOA data can trigger the one-byte out-of-bounds write and crash or corrupt the process. This issue is fixed in versions 2.1.13 and 2.2.2-alpha."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101733","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101733","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"risk":0.20600000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101733"},"relatedVulnerabilities":[{"id":"CVE-2026-101733","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101733","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101733","date":"2026-11-12","epss":0.00412,"percentile":0.35976}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101733","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101725","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101725","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101725"},"relatedVulnerabilities":[{"id":"CVE-2026-101725","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101725","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101725","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101725","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101726","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101726","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101726"},"relatedVulnerabilities":[{"id":"CVE-2026-101726","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101726","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101726","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101726","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: C API).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101728","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101728","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"risk":0.20500000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101728"},"relatedVulnerabilities":[{"id":"CVE-2026-101728","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101728","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101728","date":"2026-11-12","epss":0.0041,"percentile":0.35743}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101728","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Pluggable Auth).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101771","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101771","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101771"},"relatedVulnerabilities":[{"id":"CVE-2026-101771","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101771","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101771","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101771","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101772","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101772","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"risk":0.20400000000000001,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101772"},"relatedVulnerabilities":[{"id":"CVE-2026-101772","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"impactScore":5.9,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101772","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101772","date":"2026-11-12","epss":0.00408,"percentile":0.35536}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101772","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21964"},"relatedVulnerabilities":[{"id":"CVE-2026-21964","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21964","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21964"},"relatedVulnerabilities":[{"id":"CVE-2026-21964","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21964","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21964","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21964","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"risk":0.202,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21964"},"relatedVulnerabilities":[{"id":"CVE-2026-21964","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21964","date":"2026-11-12","epss":0.00404,"percentile":0.35173}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21964","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21936"},"relatedVulnerabilities":[{"id":"CVE-2026-21936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21936","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21937","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21937"},"relatedVulnerabilities":[{"id":"CVE-2026-21937","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21937","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21941","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21941","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21941"},"relatedVulnerabilities":[{"id":"CVE-2026-21941","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21941","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21948"},"relatedVulnerabilities":[{"id":"CVE-2026-21948","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21948","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21936"},"relatedVulnerabilities":[{"id":"CVE-2026-21936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21936","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21937","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21937"},"relatedVulnerabilities":[{"id":"CVE-2026-21937","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21937","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21941","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21941","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21941"},"relatedVulnerabilities":[{"id":"CVE-2026-21941","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21941","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21948"},"relatedVulnerabilities":[{"id":"CVE-2026-21948","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21948","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21936","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21936","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21936"},"relatedVulnerabilities":[{"id":"CVE-2026-21936","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21936","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21936","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21937","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21937","fix":{"state":"wont-fix","versions":[]},"cvss":[],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21937"},"relatedVulnerabilities":[{"id":"CVE-2026-21937","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21937","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21937","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21941","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21941","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21941"},"relatedVulnerabilities":[{"id":"CVE-2026-21941","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21941","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21941","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21941","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-21948","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-21948","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"risk":0.20049999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-21948"},"relatedVulnerabilities":[{"id":"CVE-2026-21948","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-21948","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-21948","date":"2026-11-12","epss":0.00401,"percentile":0.34831}],"urls":["https://www.oracle.com/security-alerts/cpujan2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21948","description":"Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and  9.0.0-9.5.0. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101747","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101747","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101747"},"relatedVulnerabilities":[{"id":"CVE-2026-101747","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101747","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101747","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101747","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101748","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101748","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"risk":0.1975,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101748"},"relatedVulnerabilities":[{"id":"CVE-2026-101748","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101748","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101748","date":"2026-11-12","epss":0.00395,"percentile":0.34162}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101748","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Security: Audit).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101608","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101608","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101608"},"relatedVulnerabilities":[{"id":"CVE-2026-101608","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101608","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101608","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101608","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101616","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101616","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"risk":0.197,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101616"},"relatedVulnerabilities":[{"id":"CVE-2026-101616","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101616","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101616","date":"2026-11-12","epss":0.00394,"percentile":0.34076}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101616","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101781","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101781","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"risk":0.196,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101781"},"relatedVulnerabilities":[{"id":"CVE-2026-101781","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"impactScore":5.9,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101781","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101781","date":"2026-11-12","epss":0.00392,"percentile":0.33846}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101781","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication GCS).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows unauthenticated attacker with access to the physical communication segment attached to the hardware where the MySQL Server, MySQL Cluster executes to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101801","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101801","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101801"},"relatedVulnerabilities":[{"id":"CVE-2026-101801","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101801","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101801","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101801","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101803","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101803","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101803"},"relatedVulnerabilities":[{"id":"CVE-2026-101803","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":6.5,"impactScore":5.2,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101803","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101803","date":"2026-11-12","epss":0.0039,"percentile":0.33637}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101803","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101784","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101784","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101784"},"relatedVulnerabilities":[{"id":"CVE-2026-101784","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101784","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101784","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101784","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101787","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101787","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101787"},"relatedVulnerabilities":[{"id":"CVE-2026-101787","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101787","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101787","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101787","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101798","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101798","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"risk":0.19499999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101798"},"relatedVulnerabilities":[{"id":"CVE-2026-101798","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101798","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101798","date":"2026-11-12","epss":0.0039,"percentile":0.33636}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101798","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4046","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4046","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4046","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4046","date":"2026-11-12","epss":0.00389,"percentile":0.33452}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4046"},"relatedVulnerabilities":[{"id":"CVE-2026-4046","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4046","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4046","date":"2026-11-12","epss":0.00389,"percentile":0.33452}],"urls":["https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=33980","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4046","description":"The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-4046","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-4046","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-4046","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4046","date":"2026-11-12","epss":0.00389,"percentile":0.33452}],"risk":0.19449999999999998,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-4046"},"relatedVulnerabilities":[{"id":"CVE-2026-4046","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-4046","cwe":"CWE-617","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-4046","date":"2026-11-12","epss":0.00389,"percentile":0.33452}],"urls":["https://inbox.sourceware.org/libc-announce/76814edf-cf7f-47ec-979d-2dce0a2c76bf@gotplt.org/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=33980","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0007;hb=HEAD","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-4046","description":"The iconv() function in the GNU C Library versions 2.43 and earlier may crash due to an assertion failure when converting inputs from the IBM1390 or IBM1399 character sets, which may be used to remotely crash an application.\n\n\n\nThis vulnerability can be trivially mitigated by removing the IBM1390 and IBM1399 character sets from systems that do not need them."}]},{"artifact":{"id":"d466610980c64a4f","cpes":["cpe:2.3:a:gcc-10-base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10-base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10_base:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc-10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc_10:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-10-base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_10_base:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"gcc-10-base","purl":"pkg:deb/ubuntu/gcc-10-base@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/gcc-10-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/gcc-10-base:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"ab4c954aa38d7cce","cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libgcc-s1","purl":"pkg:deb/ubuntu/libgcc-s1@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgcc-s1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"4b8e34f972831b96","cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:10.5.0-1ubuntu1\\~20.04:*:*:*:*:*:*:*"],"name":"libstdc++6","purl":"pkg:deb/ubuntu/libstdc%2B%2B6@10.5.0-1ubuntu1~20.04?arch=amd64&distro=ubuntu-20.04&upstream=gcc-10","type":"deb","version":"10.5.0-1ubuntu1~20.04","language":"","licenses":["sha256:719dd73912334e65a64c63fb1f7ccdacf70c27258570de0fb123b33d490eddf5"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-10-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libstdc++6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gcc-10"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-115455","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gcc-10","version":"10.5.0-1ubuntu1~20.04"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-115455","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"risk":0.1935,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-115455"},"relatedVulnerabilities":[{"id":"CVE-2026-115455","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H","metrics":{"baseScore":6.5,"impactScore":4.3,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-115455","cwe":"CWE-787","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-115455","date":"2026-11-12","epss":0.00387,"percentile":0.33293}],"urls":["https://access.redhat.com/errata/RHSA-2026:94989","https://access.redhat.com/errata/RHSA-2026:95581","https://access.redhat.com/errata/RHSA-2026:98526","https://access.redhat.com/errata/RHSA-2026:98534","https://access.redhat.com/errata/RHSA-2026:98633","https://access.redhat.com/errata/RHSA-2026:98640","https://access.redhat.com/errata/RHSA-2026:98648","https://access.redhat.com/errata/RHSA-2026:99632","https://access.redhat.com/security/cve/CVE-2026-115455","https://bugzilla.redhat.com/show_bug.cgi?id=2562933","https://gcc.gnu.org/cgit/gcc/commit/?id=5d419c69ce2e6b86d7da75f18736904885674219"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-115455","description":"A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0861","date":"2026-11-12","epss":0.00386,"percentile":0.33187}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0861"},"relatedVulnerabilities":[{"id":"CVE-2026-0861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0861","date":"2026-11-12","epss":0.00386,"percentile":0.33187}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33796","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001","http://www.openwall.com/lists/oss-security/2026/01/16/5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0861","description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-0861","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-0861","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0861","date":"2026-11-12","epss":0.00386,"percentile":0.33187}],"risk":0.193,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-0861"},"relatedVulnerabilities":[{"id":"CVE-2026-0861","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"impactScore":5.9,"exploitabilityScore":2.6},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-0861","date":"2026-11-12","epss":0.00386,"percentile":0.33187}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33796","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001","http://www.openwall.com/lists/oss-security/2026/01/16/5"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0861","description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this.  The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument.  This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice.  An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101760","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101760","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"risk":0.1895,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101760"},"relatedVulnerabilities":[{"id":"CVE-2026-101760","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101760","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101760","date":"2026-11-12","epss":0.00379,"percentile":0.32364}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101760","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60178","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60178","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"risk":0.1875,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60178"},"relatedVulnerabilities":[{"id":"CVE-2026-60178","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60178","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60178","date":"2026-11-12","epss":0.00375,"percentile":0.31988}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60178","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"f8c27f10f87f5e36","cpes":["cpe:2.3:a:libgnutls30:libgnutls30:3.6.13-2ubuntu1.12:*:*:*:*:*:*:*"],"name":"libgnutls30","purl":"pkg:deb/ubuntu/libgnutls30@3.6.13-2ubuntu1.12?arch=amd64&distro=ubuntu-20.04&upstream=gnutls28","type":"deb","version":"3.6.13-2ubuntu1.12","language":"","licenses":["sha256:15fad95b786ca4e9843c4319716325b58886e617fb88992ff894334b6e7c3e71"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libgnutls30/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libgnutls30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libgnutls30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"gnutls28"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-42012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"gnutls28","version":"3.6.13-2ubuntu1.12"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-42012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-42012","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42012","date":"2026-11-12","epss":0.00374,"percentile":0.31812}],"risk":0.187,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-42012"},"relatedVulnerabilities":[{"id":"CVE-2026-42012","cvss":[{"type":"Secondary","source":"secalert@redhat.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-42012","cwe":"CWE-295","type":"Secondary","source":"secalert@redhat.com"}],"epss":[{"cve":"CVE-2026-42012","date":"2026-11-12","epss":0.00374,"percentile":0.31812}],"urls":["https://access.redhat.com/errata/RHSA-2026:13274","https://access.redhat.com/errata/RHSA-2026:20611","https://access.redhat.com/errata/RHSA-2026:20612","https://access.redhat.com/errata/RHSA-2026:20613","https://access.redhat.com/errata/RHSA-2026:26319","https://access.redhat.com/errata/RHSA-2026:26409","https://access.redhat.com/errata/RHSA-2026:29197","https://access.redhat.com/errata/RHSA-2026:30004","https://access.redhat.com/errata/RHSA-2026:30849","https://access.redhat.com/errata/RHSA-2026:30850","https://access.redhat.com/errata/RHSA-2026:32962","https://access.redhat.com/errata/RHSA-2026:33125","https://access.redhat.com/errata/RHSA-2026:41921","https://access.redhat.com/errata/RHSA-2026:43575","https://access.redhat.com/errata/RHSA-2026:58981","https://access.redhat.com/errata/RHSA-2026:72502","https://access.redhat.com/errata/RHSA-2026:74674","https://access.redhat.com/errata/RHSA-2026:82304","https://access.redhat.com/errata/RHSA-2026:82322","https://access.redhat.com/errata/RHSA-2026:82347","https://access.redhat.com/errata/RHSA-2026:82354","https://access.redhat.com/errata/RHSA-2026:82372","https://access.redhat.com/errata/RHSA-2026:82857","https://access.redhat.com/errata/RHSA-2026:82888","https://access.redhat.com/errata/RHSA-2026:89197","https://access.redhat.com/errata/RHSA-2026:89232","https://access.redhat.com/errata/RHSA-2026:89333","https://access.redhat.com/errata/RHSA-2026:94442","https://access.redhat.com/security/cve/CVE-2026-42012","https://bugzilla.redhat.com/show_bug.cgi?id=2467441","https://www.gnutls.org/security-new.html#GNUTLS-SA-2026-04-29-7"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-42012","description":"A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Identifier (URI) or Service (SRV) Subject Alternative Names (SANs). This could cause the certificate validation process to incorrectly fall back to checking DNS hostnames against the Common Name (CN), potentially allowing the attacker to spoof legitimate services or intercept sensitive information."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-12","epss":0.00622,"percentile":0.50313}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-12","epss":0.00622,"percentile":0.50313}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-54874","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-54874","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-12","epss":0.00622,"percentile":0.50313}],"risk":0.1866,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-54874"},"relatedVulnerabilities":[{"id":"CVE-2026-54874","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-54874","cwe":"CWE-405","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-54874","date":"2026-11-12","epss":0.00622,"percentile":0.50313}],"urls":["https://github.com/openssl/openssl/commit/4808b5d64176451f3d93d87d0ac9c81a9b13fb23","https://github.com/openssl/openssl/commit/7110cb2f75806d0bf809eb2f90790d477900be40","https://github.com/openssl/openssl/commit/a0c8ec557d9cac078f032d76cdf684fe743eb382","https://github.com/openssl/openssl/commit/cc0c6710917cd5eec001b297355d2ba723505107","https://github.com/openssl/openssl/commit/f52ffc11b90737ac89083909618dc2e1f42c561c","https://openssl-library.org/news/secadv/20260825.txt"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-54874","description":"Issue summary: Receiving a DTLS record for a future epoch while a handshake\nis in progress causes OpenSSL to buffer far more memory than the record\nitself requires.\n\nImpact summary: A peer can use a small amount of network traffic to make an\nOpenSSL DTLS endpoint retain a disproportionately large amount of memory,\nwhich may lead to a Denial of Service.\n\nCWE: CWE-405: Asymmetric Resource Consumption (Amplification)\n\nDescription: While a DTLS handshake is in progress, a peer may legitimately\nhave already moved on to the next epoch (for example, having sent its\nChangeCipherSpec and Finished messages) before the local endpoint has\nprocessed the same transition, typically because of reordering on the\nunderlying UDP transport. OpenSSL buffers such early records so that they\ncan be processed once the local endpoint catches up.\n\nBuffering a record currently retains the entire read buffer it arrived in,\nwhich is sized to hold the largest possible DTLS record (around 16\nkilobytes), rather than just the bytes that make up the record itself. Up\nto 100 such records may be buffered per connection. As a result, a peer\nthat sends a stream of small forged records claiming to belong to the next\nepoch can cause an OpenSSL DTLS endpoint to retain around 1.7 megabytes of\nmemory, despite sending only a small fraction of that amount of data over\nthe network.\n\nAn attacker therefore gains a memory amplification factor of around 1200,\nand can multiply the effect across as many associations as it is able to\nopen, making this a remote memory exhaustion Denial of Service risk for\nDTLS servers. Since the memory retained per connection remains bounded,\nand any limit an application already places on the number of concurrent\nassociations also bounds the total exposure, this issue has been assessed\nas Low severity.\n\nFIPS impact: no\n\nNo FIPS modules are affected by this issue as the affected code is outside\nthe OpenSSL FIPS module boundary.\n\nOpenSSL 4.0, 3.6, 3.5, 3.4, 3.0, 1.1.1 and 1.0.2 are vulnerable to this\nissue.\n\nOpenSSL 4.0 users should upgrade to OpenSSL 4.0.2.\nOpenSSL 3.6 users should upgrade to OpenSSL 3.6.4.\nOpenSSL 3.5 users should upgrade to OpenSSL 3.5.8.\nOpenSSL 3.4 users should upgrade to OpenSSL 3.4.7.\nOpenSSL 3.0 users should upgrade to OpenSSL 3.0.22.\n\nPremium support customers only:\nOpenSSL 1.1.1 users should upgrade to OpenSSL 1.1.1zi\nOpenSSL 1.0.2 users should upgrade to OpenSSL 1.0.2zr\n\nThis issue was reported on 18 May 2026 by Amazon Web Services.\nThe fix has been developed by Matt Caswell.\n\n-- cut (non-publishing metadata for internal use) --\nReported by: Amazon Web Services\nFixed by: Matt Caswell"}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5928","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5928","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5928","cwe":"CWE-127","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5928","date":"2026-11-12","epss":0.00369,"percentile":0.31219}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5928"},"relatedVulnerabilities":[{"id":"CVE-2026-5928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5928","cwe":"CWE-127","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5928","date":"2026-11-12","epss":0.00369,"percentile":0.31219}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33998","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5928","description":"Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-5928","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-5928","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-5928","cwe":"CWE-127","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5928","date":"2026-11-12","epss":0.00369,"percentile":0.31219}],"risk":0.1845,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-5928"},"relatedVulnerabilities":[{"id":"CVE-2026-5928","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"impactScore":3.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-5928","cwe":"CWE-127","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-5928","date":"2026-11-12","epss":0.00369,"percentile":0.31219}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33998","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-5928","description":"Calling the ungetwc function on a FILE stream with wide characters encoded in a character set that has overlaps between its single byte and multi-byte character encodings, in the GNU C Library version 2.43 or earlier, may result in an attempt to read bytes before an allocated buffer, potentially resulting in unintentional disclosure of neighboring data in the heap, or a program crash.\n\nA bug in the wide character pushback implementation (_IO_wdefault_pbackfail in libio/wgenops.c) causes ungetwc() to operate on the regular character buffer (fp->_IO_read_ptr) instead of the actual wide-stream read pointer (fp->_wide_data->_IO_read_ptr). The program crash may happen in cases where fp->_IO_read_ptr is not initialized and hence points to NULL. The buffer under-read requires a special situation where the input character encoding is such that there are overlaps between single byte representations and multibyte representations in that encoding, resulting in spurious matches. The spurious match case is not possible in the standard Unicode character sets."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2025-69419","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69419","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-11-12","epss":0.00607,"percentile":0.49558}],"risk":0.18209999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69419"},"relatedVulnerabilities":[{"id":"CVE-2025-69419","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-11-12","epss":0.00607,"percentile":0.49558}],"urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2025-69419","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2025-69419","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-11-12","epss":0.00607,"percentile":0.49558}],"risk":0.18209999999999998,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2025-69419"},"relatedVulnerabilities":[{"id":"CVE-2025-69419","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2025-69419","date":"2026-11-12","epss":0.00607,"percentile":0.49558}],"urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101618","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101618","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101618"},"relatedVulnerabilities":[{"id":"CVE-2026-101618","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101618","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101618","date":"2026-11-12","epss":0.00364,"percentile":0.30683}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101618","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101624","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101624","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"risk":0.182,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101624"},"relatedVulnerabilities":[{"id":"CVE-2026-101624","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.9,"impactScore":3.6,"exploitabilityScore":1.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101624","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101624","date":"2026-11-12","epss":0.00364,"percentile":0.30682}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101624","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.9 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60585","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60585","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"risk":0.18,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60585"},"relatedVulnerabilities":[{"id":"CVE-2026-60585","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":6.6,"impactScore":5.9,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60585","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60585","date":"2026-11-12","epss":0.0036,"percentile":0.30208}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60585","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in takeover of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.6 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60185","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60185","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60185"},"relatedVulnerabilities":[{"id":"CVE-2026-60185","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60185","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60185","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60185","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60186","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60186","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60186"},"relatedVulnerabilities":[{"id":"CVE-2026-60186","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60186","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60186","date":"2026-11-12","epss":0.00359,"percentile":0.3003}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60186","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Group Replication Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-47012","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-47012","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-47012"},"relatedVulnerabilities":[{"id":"CVE-2026-47012","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-47012","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-47012","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-47012","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60177","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60177","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60177"},"relatedVulnerabilities":[{"id":"CVE-2026-60177","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60177","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60177","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60177","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60182","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60182","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60182"},"relatedVulnerabilities":[{"id":"CVE-2026-60182","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60182","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60182","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60182","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Clone Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60187","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60187","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"risk":0.1795,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60187"},"relatedVulnerabilities":[{"id":"CVE-2026-60187","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60187","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60187","date":"2026-11-12","epss":0.00359,"percentile":0.30029}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60187","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77117"},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-80489"},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-77117","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-77117","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-77117"},"relatedVulnerabilities":[{"id":"CVE-2026-77117","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-77117","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-77117","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34556","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0019"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-77117","description":"Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome SHIFT_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used.  The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-80489","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-80489","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-80489"},"relatedVulnerabilities":[{"id":"CVE-2026-80489","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"impactScore":3.6,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-80489","cwe":"CWE-835","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-80489","date":"2026-11-12","epss":0.00358,"percentile":0.30011}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=34568","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0020"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-80489","description":"Converting crafted EUC_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang.\n\nSome EUC_JISX0213 sequences decode to two code points.  If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call.  The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the EUC_JISX0213 character set is affected, which is not commonly used.  The related defect in SHIFT_JISX0213 converter is tracked separately as CVE-2026-77117."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-11-12","epss":0.00358,"percentile":0.29998}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6238"},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-11-12","epss":0.00358,"percentile":0.29998}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-6238","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-6238","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-11-12","epss":0.00358,"percentile":0.29998}],"risk":0.179,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-6238"},"relatedVulnerabilities":[{"id":"CVE-2026-6238","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","metrics":{"baseScore":6.5,"impactScore":2.6,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-6238","cwe":"CWE-126","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-6238","date":"2026-11-12","epss":0.00358,"percentile":0.29998}],"urls":["https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@redhat.com/T/#u","https://sourceware.org/bugzilla/show_bug.cgi?id=34069","https://cert-portal.siemens.com/productcert/html/ssa-082556.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-6238","description":"The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.0.1 to version 2.43 fail to validate the RDATA content against the RDATA length in a DNS response when processing A6, CERT, LOC, TKEY or TSIG records, which may allow an attacker to craft a DNS response, causing a target application to crash or read uninitialized memory.\n\nThese functions are for application debugging only and hence not in the path of code executed by the DNS resolver.  Further, they have been deprecated since version 2.34 and should not be used by any new applications.  Applications should consider porting away from these interfaces since they may be removed in future versions."}]},{"artifact":{"id":"c35ad62586dcdc25","cpes":["cpe:2.3:a:libperl5.30:libperl5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"libperl5.30","purl":"pkg:deb/ubuntu/libperl5.30@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libperl5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libperl5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libperl5.30:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"5d7de190a8996dbf","cpes":["cpe:2.3:a:perl:perl:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl","purl":"pkg:deb/ubuntu/perl@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.list"},{"path":"/var/lib/dpkg/info/perl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postinst"},{"path":"/var/lib/dpkg/info/perl.postrm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.postrm"},{"path":"/var/lib/dpkg/info/perl.preinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.preinst"},{"path":"/var/lib/dpkg/info/perl.prerm","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl.prerm"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"93b5b1b10fc3427f","cpes":["cpe:2.3:a:perl-base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_base:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_base:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-base","purl":"pkg:deb/ubuntu/perl-base@5.30.0-9ubuntu0.5?arch=amd64&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-base/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/perl-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-base.list","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.list"},{"path":"/var/lib/dpkg/info/perl-base.postinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postinst"},{"path":"/var/lib/dpkg/info/perl-base.postrm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.postrm"},{"path":"/var/lib/dpkg/info/perl-base.preinst","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.preinst"},{"path":"/var/lib/dpkg/info/perl-base.prerm","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/perl-base.prerm"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"65df7f18064bce28","cpes":["cpe:2.3:a:perl-modules-5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules-5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules_5.30:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl-modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl_modules:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl-modules-5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*","cpe:2.3:a:perl:perl_modules_5.30:5.30.0-9ubuntu0.5:*:*:*:*:*:*:*"],"name":"perl-modules-5.30","purl":"pkg:deb/ubuntu/perl-modules-5.30@5.30.0-9ubuntu0.5?arch=all&distro=ubuntu-20.04&upstream=perl","type":"deb","version":"5.30.0-9ubuntu0.5","language":"","licenses":["Artistic","Artistic-2","Artistic-dist","BSD-3-clause","BSD-3-clause-GENERIC","BSD-3-clause-with-weird-numbering","BSD-4-clause-POWERDOG","BZIP","DONT-CHANGE-THE-GPL","Expat","GPL-1","GPL-1+","GPL-2","GPL-2+","GPL-3+-WITH-BISON-EXCEPTION","HSIEH-BSD","HSIEH-DERIVATIVE","LGPL-2.1","REGCOMP","REGCOMP,","RRA-KEEP-THIS-NOTICE","SDBM-PUBLIC-DOMAIN","TEXT-TABS","Unicode","ZLIB"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/perl-modules-5.30/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/perl-modules-5.30/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/perl-modules-5.30.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/perl-modules-5.30.list"}],"upstreams":[{"name":"perl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-7017","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"perl","version":"5.30.0-9ubuntu0.5"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-7017","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"risk":0.1785,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-7017"},"relatedVulnerabilities":[{"id":"CVE-2026-7017","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":7.1,"impactScore":4.3,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-7017","cwe":"CWE-522","type":"Secondary","source":"9b29abf9-4ab0-4765-b253-1875cd9b441e"}],"epss":[{"cve":"CVE-2026-7017","date":"2026-11-12","epss":0.00357,"percentile":0.29833}],"urls":["https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/84984ef3930ddd4afcf5eb83b40d3cee200739c3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/8f32ca89e21c3ad0422adc698fa6ad17a193f55f.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/commit/e7a03aedf2395158f2b0d3bad2df943349227bb3.patch","https://github.com/Perl-Toolchain-Gang/HTTP-Tiny/pull/36","https://metacpan.org/release/HAARG/HTTP-Tiny-0.095-TRIAL/changes","http://www.openwall.com/lists/oss-security/2026/07/07/13","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-7017","description":"HTTP::Tiny versions before 0.095 for Perl forward credential headers to cross-origin redirect targets.\n\nWhen the server returns a 3xx redirect, `_maybe_redirect` follows the `Location:` header and `_prepare_headers_and_cb` re-merges the caller's `headers` argument into the new request, without checking whether the redirect target shares an origin with the original URL. Caller-supplied `Authorization`, `Cookie` and `Proxy-Authorization` headers are therefore re-sent to whatever host the redirect names, across scheme, host or port boundaries, and including `https` to `http` downgrades that expose them in plaintext on the wire.\n\nThe HTTP::Tiny POD note that \"Authorization headers will not be included in a redirected request\" applied only to the URL-userinfo Basic-auth path, not to headers passed explicitly by the caller."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101778","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101778","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101778"},"relatedVulnerabilities":[{"id":"CVE-2026-101778","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101778","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101778","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101778","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Components Services).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101780","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101780","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"risk":0.17750000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101780"},"relatedVulnerabilities":[{"id":"CVE-2026-101780","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101780","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101780","date":"2026-11-12","epss":0.00355,"percentile":0.2962}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101780","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: X Plugin).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"1583c4033b2af5be","cpes":["cpe:2.3:a:libssl1.1:libssl1.1:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"libssl1.1","purl":"pkg:deb/ubuntu/libssl1.1@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04&upstream=openssl","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libssl1.1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libssl1.1:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"openssl"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-12","epss":0.00589,"percentile":0.48649}],"risk":0.1767,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-22796"},"relatedVulnerabilities":[{"id":"CVE-2026-22796","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-12","epss":0.00589,"percentile":0.48649}],"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"9d14cfee9343a94c","cpes":["cpe:2.3:a:openssl:openssl:1.1.1f-1ubuntu2.24:*:*:*:*:*:*:*"],"name":"openssl","purl":"pkg:deb/ubuntu/openssl@1.1.1f-1ubuntu2.24?arch=amd64&distro=ubuntu-20.04","type":"deb","version":"1.1.1f-1ubuntu2.24","language":"","licenses":["OpenSSL"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl1.1/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/openssl/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/openssl.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.list"},{"path":"/var/lib/dpkg/info/openssl.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/openssl.postinst"}],"upstreams":[]},"matchDetails":[{"type":"exact-direct-match","found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"openssl","version":"1.1.1f-1ubuntu2.24"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-22796","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-12","epss":0.00589,"percentile":0.48649}],"risk":0.1767,"urls":[],"severity":"Low","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-22796"},"relatedVulnerabilities":[{"id":"CVE-2026-22796","cvss":[{"type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"impactScore":1.5,"exploitabilityScore":3.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","type":"Secondary","source":"openssl-security@openssl.org"}],"epss":[{"cve":"CVE-2026-22796","date":"2026-11-12","epss":0.00589,"percentile":0.48649}],"urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt","https://cert-portal.siemens.com/productcert/html/ssa-265688.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101754","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101754","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101754"},"relatedVulnerabilities":[{"id":"CVE-2026-101754","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101754","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101754","date":"2026-11-12","epss":0.00353,"percentile":0.29467}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101754","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Client programs).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-60184","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-60184","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-60184"},"relatedVulnerabilities":[{"id":"CVE-2026-60184","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-60184","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-60184","date":"2026-11-12","epss":0.00353,"percentile":0.29439}],"urls":["https://www.oracle.com/security-alerts/cpujul2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-60184","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.10, 9.7.0-9.7.1; MySQL Cluster: 8.0.0-8.0.47, 8.4.0-8.4.10 and  9.7.0-9.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101789","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101789","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101789"},"relatedVulnerabilities":[{"id":"CVE-2026-101789","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101789","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101789","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101789","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101794","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101794","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101794"},"relatedVulnerabilities":[{"id":"CVE-2026-101794","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101794","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101794","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101794","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: XML).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101802","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101802","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"risk":0.17650000000000002,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101802"},"relatedVulnerabilities":[{"id":"CVE-2026-101802","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"impactScore":3.6,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101802","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101802","date":"2026-11-12","epss":0.00353,"percentile":0.29366}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101802","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Parser).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"68b2eaee91f56791","cpes":["cpe:2.3:a:libpcre2-8-0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8-0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8_0:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2-8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2_8:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2-8-0:10.34-7ubuntu0.1:*:*:*:*:*:*:*","cpe:2.3:a:libpcre2:libpcre2_8_0:10.34-7ubuntu0.1:*:*:*:*:*:*:*"],"name":"libpcre2-8-0","purl":"pkg:deb/ubuntu/libpcre2-8-0@10.34-7ubuntu0.1?arch=amd64&distro=ubuntu-20.04&upstream=pcre2","type":"deb","version":"10.34-7ubuntu0.1","language":"","licenses":["sha256:f65dae37239e4d61a1bdeaf2ded76b8569d012a054aa042233b78615e7a83210"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libpcre2-8-0/copyright","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/usr/share/doc/libpcre2-8-0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","layerID":"sha256:470b66ea5123c93b0d5606e4213bf9e47d3d426b640d32472e4ac213186c4bb6","accessPath":"/var/lib/dpkg/info/libpcre2-8-0:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"pcre2"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-89157","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"pcre2","version":"10.34-7ubuntu0.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-89157","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-12","epss":0.00348,"percentile":0.28847}],"risk":0.174,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-89157"},"relatedVulnerabilities":[{"id":"CVE-2026-89157","cvss":[{"type":"Primary","source":"nvd@nist.gov","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"impactScore":5.2,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}},{"type":"Secondary","source":"cve@mitre.org","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L","metrics":{"baseScore":5.7,"impactScore":4.3,"exploitabilityScore":1.5},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-89157","cwe":"CWE-190","type":"Secondary","source":"cve@mitre.org"}],"epss":[{"cve":"CVE-2026-89157","date":"2026-11-12","epss":0.00348,"percentile":0.28847}],"urls":["https://github.com/PCRE2Project/pcre2/releases/tag/pcre2-10.48","https://github.com/PCRE2Project/pcre2/security/advisories/GHSA-q8g2-wprr-34m9"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-89157","description":"PCRE2 before 10.48, on 32-bit platforms, has a pcre2_pattern_convert out-of-bounds write when an attacker can provide a large pattern."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101766","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101766","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"risk":0.173,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101766"},"relatedVulnerabilities":[{"id":"CVE-2026-101766","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101766","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101766","date":"2026-11-12","epss":0.00346,"percentile":0.28587}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101766","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: Replication).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101609","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101609","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101609"},"relatedVulnerabilities":[{"id":"CVE-2026-101609","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101609","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101609","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101609","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101611","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101611","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101611"},"relatedVulnerabilities":[{"id":"CVE-2026-101611","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.4,"impactScore":3.6,"exploitabilityScore":0.8},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101611","cwe":"CWE-400","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101611","date":"2026-11-12","epss":0.00336,"percentile":0.27381}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"Medium","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101611","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: InnoDB).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 4.4 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H)."}]},{"artifact":{"id":"3677de3f609c780b","cpes":["cpe:2.3:a:libc-bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc-bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc_bin:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc-bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*","cpe:2.3:a:libc:libc_bin:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc-bin","purl":"pkg:deb/ubuntu/libc-bin@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc-bin/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc-bin/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc-bin.list","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.list"},{"path":"/var/lib/dpkg/info/libc-bin.postinst","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.postinst"},{"path":"/var/lib/dpkg/info/libc-bin.triggers","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc-bin.triggers"}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"5c3f6d7bc9f34c84","cpes":["cpe:2.3:a:libc6:libc6:2.31-0ubuntu9.18:*:*:*:*:*:*:*"],"name":"libc6","purl":"pkg:deb/ubuntu/libc6@2.31-0ubuntu9.18?arch=amd64&distro=ubuntu-20.04&upstream=glibc","type":"deb","version":"2.31-0ubuntu9.18","language":"","licenses":["sha256:40c7e1f2118531f038ca22999bd976901254e1bc5cd1b0f0211bdd064c599987"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.conffiles","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.conffiles","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/libc6:amd64.md5sums","layerID":"sha256:96771dd898a8af22f82104d24cbdc556ad5d628c401412ac259673a1ef933cf9","accessPath":"/var/lib/dpkg/info/libc6:amd64.md5sums","annotations":{"evidence":"supporting"}}],"upstreams":[{"name":"glibc"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-100290","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"glibc","version":"2.31-0ubuntu9.18"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-100290","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-100290"},"relatedVulnerabilities":[{"id":"CVE-2026-100290","cvss":[{"type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"impactScore":1.5,"exploitabilityScore":2.3},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-100290","cwe":"CWE-415","type":"Secondary","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18"}],"epss":[{"cve":"CVE-2026-100290","date":"2026-11-12","epss":0.00336,"percentile":0.27367}],"urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=31935","https://sourceware.org/bugzilla/show_bug.cgi?id=34991","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0028"],"severity":"Low","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-100290","description":"The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the same heap block twice when a memory allocation fails while a regular expression is compiled or matched.  The re_dfa_add_node (the NFA node table) and build_range_exp (bracket ranges) grow several arrays with consecutive realloc calls and store the new pointers only after all of them succeed.  When a later call fails, the pattern buffer keeps pointers to blocks that were already freed, and the error cleanup frees them again.  In regexec, the back-reference cache (match_ctx_add_entry) frees its array when a realloc fails but keeps the pointer, which is freed again on the error path.\n\nAn attacker does not need to supply a crafted regular expression: patterns large enough to grow these arrays are common.  The failure has to hit a specific allocation, though, so the issue can only be reached when the system is already under memory pressure.  An attacker who supplies the pattern or the subject string has little control over which allocation fails, so the expected impact is a crash of the process.  This issue affects all architectures and ABIs supported by the GNU C Library."}]},{"artifact":{"id":"8319ffd76d4ae952","cpes":["cpe:2.3:a:mysql-client-8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_8.0:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-8.0","purl":"pkg:deb/ubuntu/mysql-client-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]},{"artifact":{"id":"6aa1586bdd47ee4d","cpes":["cpe:2.3:a:mysql-client-core-8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core-8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core_8.0:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client-core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client_core:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_client:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-client-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_client_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-client-core-8.0","purl":"pkg:deb/ubuntu/mysql-client-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-client-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-client-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-client-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-client-core-8.0.list"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]},{"artifact":{"id":"e4d67d3b0200dd7c","cpes":["cpe:2.3:a:mysql-server-core-8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core-8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core_8.0:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server-core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server_core:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql-server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql_server:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql-server-core-8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*","cpe:2.3:a:mysql:mysql_server_core_8.0:8.0.42-0ubuntu0.20.04.1:*:*:*:*:*:*:*"],"name":"mysql-server-core-8.0","purl":"pkg:deb/ubuntu/mysql-server-core-8.0@8.0.42-0ubuntu0.20.04.1?arch=amd64&distro=ubuntu-20.04&upstream=mysql-8.0","type":"deb","version":"8.0.42-0ubuntu0.20.04.1","language":"","licenses":["Artistic","BSD-2-clause","BSD-3-clause","BSD-like","Boost-1.0","GPL-2","GPL-2+","ISC","LGPL","LGPL-2","public-domain","zlib/libpng"],"locations":[{"path":"/var/lib/dpkg/status","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/status","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/mysql-server-core-8.0/copyright","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/usr/share/doc/mysql-server-core-8.0/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.md5sums","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.list","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.list"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.shlibs"},{"path":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers","layerID":"sha256:62d30ece8c9a63d611c0b24b969625526f033a410928ef603d69d93ca301f193","accessPath":"/var/lib/dpkg/info/mysql-server-core-8.0.triggers"}],"upstreams":[{"name":"mysql-8.0"}]},"matchDetails":[{"type":"exact-indirect-match","found":{"vulnerabilityID":"CVE-2026-101785","versionConstraint":"none (unknown)"},"matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"ubuntu","version":"20.04"},"package":{"name":"mysql-8.0","version":"8.0.42-0ubuntu0.20.04.1"},"namespace":"ubuntu:distro:ubuntu:20.04"}}],"vulnerability":{"id":"CVE-2026-101785","fix":{"state":"wont-fix","versions":[]},"cvss":[],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"risk":0.168,"urls":[],"severity":"Medium","namespace":"ubuntu:distro:ubuntu:20.04","advisories":[],"dataSource":"https://ubuntu.com/security/CVE-2026-101785"},"relatedVulnerabilities":[{"id":"CVE-2026-101785","cvss":[{"type":"Secondary","source":"secalert_us@oracle.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H","metrics":{"baseScore":8.3,"impactScore":5.5,"exploitabilityScore":2.9},"version":"3.1","vendorMetadata":{}}],"cwes":[{"cve":"CVE-2026-101785","cwe":"CWE-284","type":"Secondary","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"epss":[{"cve":"CVE-2026-101785","date":"2026-11-12","epss":0.00336,"percentile":0.27334}],"urls":["https://www.oracle.com/security-alerts/cpuoct2026.html"],"severity":"High","namespace":"nvd:cpe","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-101785","description":"Vulnerability in the MySQL Server, MySQL Cluster product of Oracle MySQL (component: Server: JSON).  Supported versions that are affected are MySQL Server: 8.4.0-8.4.12, 9.7.0-9.7.3, 26.7.0-26.7.1; MySQL Cluster: 8.0.0-8.0.49, 8.4.0-8.4.12, 9.7.0-9.7.3 and  26.7.0-26.7.1. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server, MySQL Cluster.  Successful attacks of this vulnerability can result in  unauthorized creation, deletion or modification access to critical data or all MySQL Server, MySQL Cluster accessible data as well as  unauthorized read access to a subset of MySQL Server, MySQL Cluster accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server, MySQL Cluster. CVSS 3.1 Base Score 8.3 (Confidentiality, Integrity and Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)."}]}],"grade":"F","score":"0.00","as_of":"2026-11-14T05:33:07.421Z","grype_db_version":"2026-11-13T15:40:34.000Z"}